note 75487 deleted from function.mysql-real-escape-string by nlopess
| From: | nlopess@php.net | Date: | Tue, 19 Jun 2007 12:21:43 +0000 |
| Subject: | note 75487 deleted from function.mysql-real-escape-string by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-127746@lists.php.net to get a copy of this message | ||
Note Submitter: Gary Ack
----
In example 1402a if someone managed to pass
$_POST['user_id'] = " '') -- insert malicious sql here "
(that's quote, apostrophe, apostrophe, quote)
then wouldn't you be in trouble?
I always try to mysql_real_escape_string all values. Even when you expect them to be digits.