Re: Select and $_POST
| From: | Richard Lynch | Date: | Thu, 10 Nov 2005 21:53:37 +0000 |
| Subject: | Re: Select and $_POST | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-225559@lists.php.net to get a copy of this message | ||
On Wed, November 9, 2005 5:21 pm, Ross wrote:
> $query = "SELECT * FROM login where username='$_POST['username']' AND
> pass
> ='$_POST['pass']'";
In addition to the fine posts regarding SQL Injection and curly
braces, I'd like to provide one other alternative heretofore
unmentioned:
$query = "SELECT * FROM login where username = '$_POST[username]' AND
pass = '$_POST[pass]'";
PHP is happy to interpolate arrays within quotes, but only if you do
NOT quote the index.
"{$array['key']}" -- good, after PHP 4.?.?
"$array[key]" -- good
"$array['key']" -- bad
--
Like Music?
http://l-i-e.com/artists.htm