note 63352 deleted from tutorial.forms by bjori
| From: | bjori@php.net | Date: | Tue, 21 Mar 2006 10:27:05 +0000 |
| Subject: | note 63352 deleted from tutorial.forms by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-106137@lists.php.net to get a copy of this message | ||
Note Submitter:
Reason: in docs
----
Taking user input and concatinating it to a SQL query is one of the worst things you can ever do.
What if I were to provide this as the username in your example:
joe; update user set password = 'password'
ALWAYS convert user input into variables and call stored procedures to do the work.
And developers wonder why DBA's wont give them admin rights....