Re: Comments on PHP security
| From: | Lukas Kahwe Smith | Date: | Sat, 13 Jan 2007 16:07:24 +0000 |
| Subject: | Re: Comments on PHP security | ||
| References: | 1 2 3 4 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-27425@lists.php.net to get a copy of this message | ||
Stefan Esser wrote:
SELECT xyz FROM abc WHERE product_id IN ( 1,2,3,4,5) <- the list having dynamic lenghtThey have worked in PEAR::DB and some other DBAL's, as a result a lot of people have come to think of prepared statements as a sprintf() replacement. By the nature of prepared statements they only work with single literals, which a list of values isnt. regards, Lukas