RE: [PHP] PHP Security Leak (plaintext)
| From: | Richard Archer | Date: | Thu, 25 Apr 2002 22:32:26 +0000 |
| Subject: | RE: [PHP] PHP Security Leak (plaintext) | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-94683@lists.php.net to get a copy of this message | ||
At 4:00 PM -0500 25/4/02, Joshua b. Jore wrote:
>"INSERT INTO foo (a,b) VALUES (?,?)"
$my_val_a = addslashes($HTTP_POST_VARS["val_a"]);
$my_val_b = addslashes($HTTP_POST_VARS["val_b"]);
$query = "INSERT INTO foo (a,b) VALUES ($my_val_a,$my_val_b)";
Or if you have magic_quotes_gpc turned on (the default) all vars passed
in from forms/cookies are quoted and SQL injection is not possible.
...R.