note 48436 deleted from security.database.sql-injection by bjori
| From: | bjori@php.net | Date: | Wed, 12 Apr 2006 15:04:42 +0000 |
| Subject: | note 48436 deleted from security.database.sql-injection by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-107889@lists.php.net to get a copy of this message | ||
Note Submitter: tazsingh at gmail dot com
----
Hi
There is one small error with the above code... It still is an array, and arrays start with 0, not
1.
So the query code should be
<?php
$sqlQuery = 'SELECT col1, col2 FROM tab1 WHERE col1 = {0} AND col3 = {1} LIMIT {2}';
$stm = mysql_query(prepareSQL($sqlQuery, array('username', 24.3, 20);
?>
instead of
<?php
$sqlQuery = 'SELECT col1, col2 FROM tab1 WHERE col1 = {1} AND col3 = {2} LIMIT {3}';
$stm = mysql_query(prepareSQL($sqlQuery, array('username', 24.3, 20);
?>
It is a common mistake with programmers, and it makes all the difference.
Ich dien