Re: Uploading Image using PHP and mySQL
| From: | Daniel Brown | Date: | Tue, 19 Feb 2008 15:43:17 +0000 |
| Subject: | Re: Uploading Image using PHP and mySQL | ||
| References: | 1 2 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-44628@lists.php.net to get a copy of this message | ||
On Feb 18, 2008 6:56 PM, Chris <dmagick@gmail.com> wrote:
> $query = "INSERT INTO artist (name,about_u,imgdata, profile_url)
>
> VALUES('$aname','$aboutu','$uploadedImage','$url_provided')";
>
> You have an sql injection problem here. Read up about that on the
> phpsec.org site:
>
> http://phpsec.org/projects/guide/3.html#3.2
>
> and a really good basic guide here:
>
> http://unixwiz.net/techtips/sql-injection.html
And in addition to the links Chris suggested, also RTFM on
mysql_real_escape_string(). It'll be your new best friend (unless
you're already using mysqli).
--
</Dan>
Daniel P. Brown
Senior Unix Geek
<? while(1) { $me = $mind--; sleep(86400); } ?>