note 91266 added to security.database.sql-injection

An anonymous comment below suggests using PEAR with prepare() / execute() - though it was posted 3 years ago, it is still true today, though it's even easier now since PDO is included in most distributions. For SET/WHERE clauses and INSERT statements, just prepare the query with question marks in place of the dynamic parameters, bind each value in, then execute it, and it'll do all of the escaping for you, rendering the query immune to injection. Dynamic substitution of ORDER BY or LIMIT clauses has to be done the old fashioned way, though, so you still need to be careful with those. Even without PDO, if you're using Postgres, you've already got the means to use parameterized queries, and if you're using MySQL, you simply need to ignore the outdated "mysql" extension and use "mysqli" instead. ---- Server IP: 69.147.83.197 Probable Submitter: 76.230.7.235 ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- https://master.php.net/note/edit/91266 Del: integrated -- https://master.php.net/note/delete/91266/integrated Del: useless -- https://master.php.net/note/delete/91266/useless Del: bad code -- https://master.php.net/note/delete/91266/bad+code Del: spam -- https://master.php.net/note/delete/91266/spam Del: non-english -- https://master.php.net/note/delete/91266/non-english Del: in docs -- https://master.php.net/note/delete/91266/in+docs Del: other reasons-- https://master.php.net/note/delete/91266 Reject -- https://master.php.net/note/reject/91266 Search -- https://master.php.net/manage/user-notes.php