note 79060 deleted from function.mysql-query by sp
| From: | sp@php.net | Date: | Sat, 24 May 2008 20:55:07 +0000 |
| Subject: | note 79060 deleted from function.mysql-query by sp | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-139709@lists.php.net to get a copy of this message | ||
Note Submitter: Geert
----
@ x_terminat_or_3 at yahoo dot fr
10-Mar-2007 12:27
"However, I read somewhere that it is good practice to add a semicolon at the end of your
query, and that it increases security against SQL-injection attacks. Therefore I have issued a
requirement that all my developers end queries with semicolons."
Erm... I don't believe you've understood the principle of executing one query at the same
time, as the manual explains. Suffixing your query with a semicolon does not influence vulnerability
to SQL-injection; as PHP would otherwise add the semicolon by itself at the end of your query.
Better instruct your developers that they use mysql_real_escape_string and surround user input in
queries with single quotes (').