note 70578 added to function.mysql-real-escape-string

I concur with icydee. It's important that SQL Injection is prevented on the server side. A person (or software) doing SQL Injection on your site will often post to your page from one of his own making. For example, you may present a page like the following on http://examplesite.com/ that sanitizes all data before submitting. <html> <head><script type="text/javascript" src="validation.js" /></head> <body> <form method="POST" action="/login.php"> Name: <input type="text" name="the_acount" value="" /><br/> Password: <input type="password" name="pwd" value="" /><br/> <input type="submit" name="action" value="Submit" onClick="Sanitize()"/> </body> </html> Your attacker views the source code and makes his own login page on his local hard drive. It doesn't have to look like or even load from your page as long as he posts the form data to your site using your expected parameters. <html><body> <form method="POST" action="http://examplesite.com/login.php"> <input type="hidden" name="the_acount" value="1'; drop table users; select 1 where name='" /><br/> Password: <input type="hidden" name="pwd" value="Oh, was I supposed to be hashed?" /><br/> <input type="submit" name="action" value="Submit" /> </body></html> ---- Server IP: 216.194.113.175 Probable Submitter: 167.235.252.243 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/70578 Del: integrated -- https://master.php.net/note/delete/70578/integrated Del: useless -- https://master.php.net/note/delete/70578/useless Del: bad code -- https://master.php.net/note/delete/70578/bad+code Del: spam -- https://master.php.net/note/delete/70578/spam Del: non-english -- https://master.php.net/note/delete/70578/non-english Del: in docs -- https://master.php.net/note/delete/70578/in+docs Del: other reasons-- https://master.php.net/note/delete/70578 Reject -- https://master.php.net/note/reject/70578 Search -- https://master.php.net/manage/user-notes.php