note 101887 deleted from sqlite3.escapestring by aharvey
| From: | aharvey@php.net | Date: | Mon, 03 Sep 2012 09:05:48 +0000 |
| Subject: | note 101887 deleted from sqlite3.escapestring by aharvey | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-190444@lists.php.net to get a copy of this message | ||
Note Submitter: rebles at myupb dot com
----
SQLite3::escapeString() should be used on every piece of user input before constructing the query
string, or *after* constructing the query string?
Calling this function on user input BEFORE constructing the query string can lead to interesting
results. For instance, it truncates e-mail addresses in an un-usable manor.