note 109917 deleted from sqlite3.escapestring by aharvey
| From: | aharvey@php.net | Date: | Mon, 03 Sep 2012 09:05:50 +0000 |
| Subject: | note 109917 deleted from sqlite3.escapestring by aharvey | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-190445@lists.php.net to get a copy of this message | ||
Note Submitter: Grzegorz.Z.
----
Hello,
This is my first post on notes here :) So be kind :)
at: koalay at gmail dot com
Can't agree with your because both cases are vulnerable to injection:
<?php
// this should be OK
$sql = sprintf("INSERT INTO table1 (somestr1, somestr2) VALUES ('%s',
'%s')",
$dbhandle->($somestr1), $dbhandle->($somestr1));
$dbhandle->query($sql);
// No, it wouldn't since you do not escape ' characters with SQLite3::escapeString().
// Unless magically $dbhandle->($somestr1) is doing same as
$dbhandle->escapeString($somestr1);
?>