Re: preventing sql injections
| From: | 1LT John W. Holmes | Date: | Wed, 18 Dec 2002 14:13:11 +0000 |
| Subject: | Re: preventing sql injections | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-128716@lists.php.net to get a copy of this message | ||
> >addslashes should be enough and put qoutes arround your strings in the
sql
>
> Meaning that a query like this one is safe, as long as I first have
> $e_namn = addslashes($e_namn);?
>
> $query = "INSERT INTO addr (last_name, first_name, email)
> VALUES(\"$e_namn\",\"$f_namn\",\"$email\")";
Yeah, as long as you do the same for $f_namn and $email.
---John Holmes...