Re: SQL Injection
| From: | Govinda | Date: | Fri, 08 Jun 2012 17:31:30 +0000 |
| Subject: | Re: SQL Injection | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-318199@lists.php.net to get a copy of this message | ||
>> Is it possible to have a "meeting of the minds" to come up with (an)
>> appropriate method(s)?
> Minds, meet prepared statements :)
> PDO is the way to go :D
Not to refute the above advice one bit (not to mention oppose the arguments against escaping in
general) ... but just curious - can anyone demo a hack that effectively injects past
mysqli_real_escape_string(), while using utf-8 ? It may just be a matter of time (or already?)
before mysqli_real_escape_string is *proven* ineffective (w/utf-8) ... but here I am just attempting
to gather facts.
Thanks
-Govinda