Re: Passing variables
| From: | Travis Doherty | Date: | Thu, 22 Mar 2007 19:30:11 +0000 |
| Subject: | Re: Passing variables | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-251121@lists.php.net to get a copy of this message | ||
itoctopus wrote:
>Since you're new to this, always be sure to clean up the output you get from
>$_GET or $_POST to avoid sql injection.
>
>Fore example: $search_value = htmlentities($_GET['search_value'],
>ENT_QUOTES);
>If you're casting to something other than a string (such as int) than you're
>safe and you don't have to use htmlentities.
>
>
>
Good call. One better is prepared statements. Avoid the problem all
together.
Travis Doherty