note 109917 added to sqlite3.escapestring

Hello, This is my first post on notes here :) So be kind :) at: koalay at gmail dot com Can't agree with your because both cases are vulnerable to injection: <?php // this should be OK $sql = sprintf("INSERT INTO table1 (somestr1, somestr2) VALUES ('%s', '%s')", $dbhandle->($somestr1), $dbhandle->($somestr1)); $dbhandle->query($sql); // No, it wouldn't since you do not escape ' characters with SQLite3::escapeString(). // Unless magically $dbhandle->($somestr1) is doing same as $dbhandle->escapeString($somestr1); ?> ---- Server IP: 69.147.83.197 Probable Submitter: 95.49.206.220 ---- Manual Page -- http://www.php.net/manual/en/sqlite3.escapestring.php Edit -- https://master.php.net/note/edit/109917 Del: integrated -- https://master.php.net/note/delete/109917/integrated Del: useless -- https://master.php.net/note/delete/109917/useless Del: bad code -- https://master.php.net/note/delete/109917/bad+code Del: spam -- https://master.php.net/note/delete/109917/spam Del: non-english -- https://master.php.net/note/delete/109917/non-english Del: in docs -- https://master.php.net/note/delete/109917/in+docs Del: other reasons-- https://master.php.net/note/delete/109917 Reject -- https://master.php.net/note/reject/109917 Search -- https://master.php.net/manage/user-notes.php