note 107480 deleted from function.mysql-real-escape-string by danbrown
| From: | danbrown@php.net | Date: | Thu, 10 May 2012 21:06:04 +0000 |
| Subject: | note 107480 deleted from function.mysql-real-escape-string by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-187855@lists.php.net to get a copy of this message | ||
Note Submitter: hnpilot
----
To answer the previous comment.
You are not supposed to send the sql sentence to the function, but only for user provided parameters
of the sql sentence to be sure that user can't inject sql code.
Say, you ask that menu-attribute of your example from user, it would become:
$attr=$_POST['attr'];
$sql="Select * from table where attribute = '" . mysql_real_escape_string($attr) .
"'"';