note 95968 added to function.mssql-query

To avoid SQL Injection, if you want to have multiple named parameters without writing stored procedures you can use built in stored procedure sp_executesql and mssql_query: <?php //Returns records with Id#46 or first name starting with 'Mary' $server = '127.0.0.1'; $link = mssql_connect($server, 'sql_user', 'sql_user_pass'); //Select DB $dbn = 'dbName'; mssql_select_db($dbn); //input variables $name='Mary%'; $id=46; //necesssary for stored procedure $params="@name varchar(50),@id int"; $paramslist="@name='$name',@id='$id'"; $sql = "select FirstName,LastName,EmpId from employees where FirstName like @name or EmpId = @id " ; $dbsql = "EXEC sp_executesql N'$sql', N'$params', $paramslist"; //important to have the "N'" ! // didn't have a problem with using varchar for all my inputs on updates no matter what field type in db. Seems MSSQL casts the input variable to the field type. $result=mssql_query($dbsql,$link); ?> for more info on sp_executesql go here: http://msdn.microsoft.com/en-us/library/ms188001.aspx works on MSSQL 2000,2005,2008 ---- Server IP: 69.147.83.197 Probable Submitter: 76.184.153.100 ---- Manual Page -- http://www.php.net/manual/en/function.mssql-query.php Edit -- https://master.php.net/note/edit/95968 Del: integrated -- https://master.php.net/note/delete/95968/integrated Del: useless -- https://master.php.net/note/delete/95968/useless Del: bad code -- https://master.php.net/note/delete/95968/bad+code Del: spam -- https://master.php.net/note/delete/95968/spam Del: non-english -- https://master.php.net/note/delete/95968/non-english Del: in docs -- https://master.php.net/note/delete/95968/in+docs Del: other reasons-- https://master.php.net/note/delete/95968 Reject -- https://master.php.net/note/reject/95968 Search -- https://master.php.net/manage/user-notes.php