Re: MySql Injection advice
| From: | Phpster | Date: | Sat, 11 Jul 2009 14:10:59 +0000 |
| Subject: | Re: MySql Injection advice | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-295198@lists.php.net to get a copy of this message | ||
On Jul 10, 2009, at 10:12 PM, Haig Dedeyan <hdedeyan@videotron.ca> wrote:
Hi everyone, I'm starting to experiment with an edit form and I am seeing the following behaviour: $fname = mysql_real_escape_string($fname); $lname = mysql_real_escape_string($lname); $sql = "UPDATE phonedir SET fname = '$fname',lname = '$lname' WHERE id=$id"; $result = mysql_query($sql); echo mysql_error() . "\n"; This will result in the addition of the slashes. If I do the following, there are no slashes. Just wondering if I'm on the right path with the 1st code set.. $sql = "UPDATE phonedir SET fname = '".mysql_real_escape_string($fname)."',lname = '".mysql_real_escape_string($lname)."' WHERE id=$id"; $result = mysql_query($sql); echo mysql_error() . "\n"; Cheers HaigCheck that magic_quotes are turned off. Bastien Sent from my iPod