Re: Malicious SQL
| From: | Reuben D. Budiardja | Date: | Thu, 08 Jul 2004 13:38:48 +0000 |
| Subject: | Re: Malicious SQL | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-189960@lists.php.net to get a copy of this message | ||
On Wednesday 07 July 2004 12:05, Keith Greene wrote:
> on the contrary:
> sql = mysql_query("select * from users where name='".$name."'");
>
> will simply look for a user with a name of "Jim; delete from users;" and
> return no results found.
But I can also enter:
jim'; delete from users
You need to catch if there's a quote in the $name too, and escape that.
RDB