note 65948 added to security.database

Encrypting user input doesn't do much to guard against SQL injection attacks. Naturally, you want to encrypt sensitive information across the wire, but if a user puts in malicious data into an input field, any encryption scheme will just dutifully unpack it at the other and and still run the SQL injection hack if you haven't guarded against it. Encryption is not magic pixie dust to sprinkle on things to make them more secure. ---- Server IP: 66.163.161.117 Probable Submitter: 64.203.237.248 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/security.database.php Edit -- http://master.php.net/note/edit/65948 Del: integrated -- http://master.php.net/note/delete/65948/integrated Del: useless -- http://master.php.net/note/delete/65948/useless Del: bad code -- http://master.php.net/note/delete/65948/bad+code Del: spam -- http://master.php.net/note/delete/65948/spam Del: non-english -- http://master.php.net/note/delete/65948/non-english Del: in docs -- http://master.php.net/note/delete/65948/in+docs Del: other reasons-- http://master.php.net/note/delete/65948 Reject -- http://master.php.net/note/reject/65948 Search -- http://master.php.net/manage/user-notes.php