MySql Injection advice
| From: | Haig Dedeyan | Date: | Sat, 11 Jul 2009 02:12:54 +0000 |
| Subject: | MySql Injection advice | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-295193@lists.php.net to get a copy of this message | ||
Hi everyone,
I'm starting to experiment with an edit form and I am seeing the following
behaviour:
$fname = mysql_real_escape_string($fname);
$lname = mysql_real_escape_string($lname);
$sql = "UPDATE phonedir SET fname = '$fname',lname = '$lname' WHERE
id=$id";
$result = mysql_query($sql);
echo mysql_error() . "\n";
This will result in the addition of the slashes.
If I do the following, there are no slashes. Just wondering if I'm on the
right path with the 1st code set..
$sql = "UPDATE phonedir SET fname =
'".mysql_real_escape_string($fname)."',lname =
'".mysql_real_escape_string($lname)."' WHERE id=$id";
$result = mysql_query($sql);
echo mysql_error() . "\n";
Cheers
Haig