Re: syntax question
| From: | itoctopus | Date: | Tue, 27 Mar 2007 00:00:12 +0000 |
| Subject: | Re: syntax question | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-251429@lists.php.net to get a copy of this message | ||
Escape it, use either htmlentities (with ENT_QUOTES) or addslashes.
--
itoctopus - http://www.itoctopus.com
""Richard Lynch"" <ceo@l-i-e.com> wrote in message
news:45049.216.230.84.67.1174937044.squirrel@www.l-i-e.com...
> On Mon, March 26, 2007 9:59 am, Ross wrote:
> > Can I put post values directly into insert statements?
> >
> > $query = "INSERT INTO categories (category_name) VALUES
> > ('$_POST['cat_name'])";
>
> Sure!
>
> If you want your webserver to get hacked by the Bad Guys, just go
> right ahead and do that.
>
> [that was tounge-in-cheek]
>
> Start reading here:
> http://phpsec.org
>
> --
> Some people have a "gift" link here.
> Know what I want?
> I want you to buy a CD from some indie artist.
> http://cdbaby.com/browse/from/lynch
> Yeah, I get a buck. So?