Re: Problems passing variables from Javascript to PHP
| From: | David Otton | Date: | Tue, 17 Jun 2003 18:09:06 +0000 |
| Subject: | Re: Problems passing variables from Javascript to PHP | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-151870@lists.php.net to get a copy of this message | ||
On Tue, 17 Jun 2003 17:00:26 +0200, you wrote:
>I'm embedding an SQL query constructed in Javascript to an URL and opening
>it in PHP where I try to execute it.
I can't believe anyone hasn't jumped on this yet :)
Please be very, very careful. There's a big big hole there.
>Problem is, the string arrives garbled, with all the apostrophes escaped.
Escaped how, exactly? With backslashes? Doubled apostrophes?
The obvious thing would be a
$query = str_replace("''", "'", $query);
But again, please reconsider what you're doing - it sounds like you're
trusting the client way too much. If you go ahead, ask on a
database-specific mailing list about the holes you need to plug.