RE: [PHP-DB] Re: Basic MySQL Query Question
| From: | Ed Lazor | Date: | Mon, 16 Aug 2004 17:06:20 +0000 |
| Subject: | RE: [PHP-DB] Re: Basic MySQL Query Question | ||
| References: | 1 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-35728@lists.php.net to get a copy of this message | ||
Is it just me or is this a very bad thing from a security standpoint? It
seems to me that user input should always be filtered before use. Otherwise
there's nothing stopping a hacker from embedding sql into the value of the
name variable.
> -----Original Message-----
> Insert into members (name) values ($_POST['name']);