svn: /phpdoc/en/trunk/reference/pdo/pdo/ prepare.xml

vrana Thu, 19 Nov 2009 10:56:57 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=290976 Log: Safety note (bug #47943) Bug: http://bugs.php.net/47943 (Open) PDO Prepare Documentation Changed paths: U phpdoc/en/trunk/reference/pdo/pdo/prepare.xml Modified: phpdoc/en/trunk/reference/pdo/pdo/prepare.xml =================================================================== --- phpdoc/en/trunk/reference/pdo/pdo/prepare.xml 2009-11-19 10:53:20 UTC (rev 290975) +++ phpdoc/en/trunk/reference/pdo/pdo/prepare.xml 2009-11-19 10:56:57 UTC (rev 290976) @@ -22,6 +22,8 @@ for which real values will be substituted when the statement is executed. You cannot use both named and question mark parameter markers within the same SQL statement; pick one or the other parameter style. + Use these parameters to bind any user-input, do not include the user-input + directly in the query. </para> <para> You must include a unique parameter marker for each value you wish to pass