Avoiding SQL injections: htmlentities() ?
| From: | Ryan A | Date: | Sun, 27 Mar 2005 07:28:41 +0000 |
| Subject: | Avoiding SQL injections: htmlentities() ? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-211639@lists.php.net to get a copy of this message | ||
Hi,
Just a quick question, I have been reading a lot about SQL injection doing a
s**tload of damage to many sites, I myself use a pagentation class which
sends the page number from page to page in a $_GET['page'] request which
gets used in a LIMIT parameter.
From what i have been reading, wrapping all my GET and POST requests in a
htmlentities() function should keep me safe....right? or what else should
i/can i do?
eg:
$page= htmlentities($_GET[page]);
Thanks,
Ryan
--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.8.3 - Release Date: 3/25/2005