Re: syntax question
| From: | cajbecu | Date: | Mon, 26 Mar 2007 15:06:18 +0000 |
| Subject: | Re: syntax question | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-251370@lists.php.net to get a copy of this message | ||
Ross wrote:
> Can I put post values directly into insert statements?
>
> $query = "INSERT INTO categories (category_name) VALUES
> ('$_POST['cat_name'])";
>
Yes you can, but it is not secure to do that!
use (insecure):
$query = "INSERT INTO categories (category_name) VALUES
('{$_POST['cat_name']}')";