Re: MySql Injection advice
| From: | Haig Dedeyan | Date: | Mon, 13 Jul 2009 12:39:44 +0000 |
| Subject: | Re: MySql Injection advice | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-295315@lists.php.net to get a copy of this message | ||
On July 12, 2009 03:34:49 pm Haig Dedeyan wrote:
> On Sat, 11 Jul 2009 21:26:36 -0400, Haig Dedeyan wrote:
> >> On Sun, Jul 12, 2009 at 4:09 AM, Haig Dedeyan <hdedeyan@videotron.ca>
wrote:
> >>> mysql_query("INSERT INTO phonedir
> >>> (fname, lname) VALUES('$new_fname','$new_lname')")
> >>> or die(mysql_error());
> >
> > I won;t be using 2x escapes but I just need to know if I should be seeing
> > the backslash in the dbase.
>
> No, the backslashes should not be stored in the database.
> They are only there to tell the database engine how to
> separate data from the SQL syntax.
>
>
> /Nisse
Ahhh. Thanks for the info.
Cheers
Haig