Re: SEARCHING for an answer...
| From: | Stut | Date: | Tue, 11 Sep 2007 18:10:53 +0000 |
| Subject: | Re: SEARCHING for an answer... | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-261958@lists.php.net to get a copy of this message | ||
Jason Pruim wrote:
On Sep 11, 2007, at 1:22 PM, Instruct ICC wrote:That couldn't be less relevant. Repeat after me... "Legitimate" users can be malicious too. All data going into a SQL statement needs to be escaped unless it's a hard-coded string. No exceptions. Ever. -Stut -- http://stut.net/Also read http://en.wikipedia.org/wiki/SQL_injectionI have read about SQL injection, and I will be scrubbing the data before searching but the search is only available after logging into the system. No one who isn't logged in can even view the page :)