Re: escape your variables
| From: | Eric Butera | Date: | Thu, 05 Mar 2009 01:11:08 +0000 |
| Subject: | Re: escape your variables | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-289318@lists.php.net to get a copy of this message | ||
On Wed, Mar 4, 2009 at 8:04 PM, PJ <af.gourmet@videotron.ca> wrote some stuff...
You should do a little reading on some of the keywords that have been presented.
Specifically you don't sanitize a value into your db. You escape it.
Prepared statements are a way of doing this that makes it a bit harder
to mess up. You have to have a connection to the server to properly
escape your value because databases can have lots of different
character encodings. Just blindly assuming latin1 is wrong.
--
http://www.voom.me | EFnet: #voom