Re: Inserting NULL Integer Values

From: Date: Sat, 29 Oct 2005 09:45:51 +0000
Subject: Re: Inserting NULL Integer Values
References: 1 2  Groups: php.general 
Request: Send a blank email to php-general+get-224800@lists.php.net to get a copy of this message
Oliver Grätz wrote:
Shaun schrieb:
$qid = mysql_query('INSERT INTO MYTABLE (
                               column1,
                               column2,
                              ) VALUES (
                               "'.$value1.'",
                               "'.$value2.'"
                              )');
A bit off-topic but important: Always make sure that you check the contents of $value1 and $value2 before putting them into the query! With $value1 = 'xyz","xyz"); DELETE FROM MYTABLE;'; you might get surprising results! This is called SQL injection and it's important to escape all the values before putting them into the statement.
Did you try that? This doesn't work on my machine: mysql_query("DELETE FROM mytable; DELETE FROM mytable;"); ie, mysql extension won't let me do more than one statement at a time. -- Open source PHP code generator for DB operations http://sourceforge.net/projects/bfrcg/

« previous php.general (#224800) next »