Re: Re: radio form submission
| From: | Richard Quadling | Date: | Fri, 24 Jun 2011 15:28:46 +0000 |
| Subject: | Re: Re: radio form submission | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-313701@lists.php.net to get a copy of this message | ||
On 24 June 2011 15:44, Vitalii Demianets <vitas@nppfactor.kiev.ua> wrote:
> On Friday 24 June 2011 17:28:08 Chris Stinemetz wrote:
>> That worked perfectly!
>
> And will work, until you decide to put quotes in button name for some reason.
> And until some malicious user forge POST request with
> $_POST['post_tptest'] = "'; DROP DATABASE; --"
> But you can use prepared statements to be safe ) ...and they don't need all
> those fancy quoting/escaping/sanitizing ...and they have advantages for
> repetitive operations.
> And furthermore, I think Carthage must be destroyed.
http://xkcd.com/327/
--
Richard Quadling
Twitter : EE : Zend : PHPDoc
@RQuadling : e-e.com/M_248814.html : bit.ly/9O8vFY : bit.ly/lFnVea