Re: does magic_quotes_gpc prevents sql injection through forms?
| From: | Dave Goodchild | Date: | Mon, 11 Sep 2006 12:10:22 +0000 |
| Subject: | Re: does magic_quotes_gpc prevents sql injection through forms? | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-241579@lists.php.net to get a copy of this message | ||
Yes. Always treat incoming data as if it were tainted. How rigorous you are
is up to you, but check for required fields, then validate them (type, size
etc) and finally escape before database entry.
http://www.projectkarma.co.uk-- http://www.web-buddha.co.uk http://www.projectkarma.co.uk