Re: Re: session variable in select query showing picture from database
| From: | Christopher Jones | Date: | Thu, 12 Feb 2009 19:28:13 +0000 |
| Subject: | Re: Re: session variable in select query showing picture from database | ||
| References: | 1 2 3 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-45946@lists.php.net to get a copy of this message | ||
It's always better not to concatenate user input into queries, otherwise you are vulnerable to SQL Injection attacks: http://www.sans.org/top25errors/#cat1 Use bind variables with the appropriate syntax for your database. Chris -- Email: christopher.jones@oracle.com Tel: +1 650 506 8630 Twitter: http://twitter.com/ghrd Free PHP Book: http://tinyurl.com/UGPOM$band_id = $_SESSION['session_var']; $query="SELECT * FROM pic_upload WHERE band_id=$band_id";