note 120304 added to security.database.sql-injection

Nikolay Mihaylov , Your security measure is completely vulnerable and it's very poor. What if your client is doing an EVAL on unfiltered user input, and the attacker injects something like: $code = "base" . "64_encode"; $encoded = $code("LOL"); print $encoded; For those new to PHP reading this, DON'T do what Nikolay Mihaylov suggested, please. ---- Server IP: 72.52.91.14 Probable Submitter: 189.173.203.196 ---- Manual Page -- http://php.net/manual/en/security.database.sql-injection.php Edit -- https://master.php.net/note/edit/120304 Del: integrated -- https://master.php.net/note/delete/120304/integrated Del: useless -- https://master.php.net/note/delete/120304/useless Del: bad code -- https://master.php.net/note/delete/120304/bad+code Del: spam -- https://master.php.net/note/delete/120304/spam Del: non-english -- https://master.php.net/note/delete/120304/non-english Del: in docs -- https://master.php.net/note/delete/120304/in+docs Del: other reasons-- https://master.php.net/note/delete/120304 Reject -- https://master.php.net/note/reject/120304 Search -- https://master.php.net/manage/user-notes.php