note 107402 deleted from reserved.variables.get by danbrown
| From: | danbrown@php.net | Date: | Thu, 10 May 2012 17:06:13 +0000 |
| Subject: | note 107402 deleted from reserved.variables.get by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-187647@lists.php.net to get a copy of this message | ||
Note Submitter: gerjoo at gmail dot com
----
In reply to zgold at 10-Aug-2011 01:58.
Using just htmlentities to "secure" your data will not protect you from SQL injections.
Slashes are not escaped by the "htmlentities" function, if this is currently your only
line of defence, you are vulnerable for SQL injections!
To "secure" your data within this context, look into mysql_real_escape_string.
Alternatively, feel free to read into "prepared statements".
Please note that mysql_real_escape_string is not a replacement for htmlentities, they can be used
together depending on your requirements.
- Gerard