does magic_quotes_gpc prevents sql injection through forms?
| From: | Reinhart Viane | Date: | Mon, 11 Sep 2006 10:55:30 +0000 |
| Subject: | does magic_quotes_gpc prevents sql injection through forms? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-241576@lists.php.net to get a copy of this message | ||
After some comments on my code I went on a 'fieldtrip' to learn about sql
injection...
Now after testing some examples with single and double quotes and mysql
comment (--) I haven't find any way to insert edit or delete any data in the
database.
The loginscript is rather simple:
$query="SELECT FROM persons WHERE login='$login' AND
password='$password'";
$result=mysql_query($query) or die(mysql_error());
The form has action POST.
Now magic_quotes_gpc escapes every quote I insert.
Does this mean with magic_quotes_gpc on I am secured enough concerning
mysql-injection through forms?
Thx