note 120305 added to security.database.sql-injection

To : jaimthorn at yahoo dot com # My 2 cents: It happens in the real world that users usually want to find text in their databases, so having them all binary coded not only makes it harder find, you spend more money doing database lookups, and your lookups will take forever in large databases. # My suggestion: SANITIZE user input, everything. Cookies, POST, GET, Headers, Files, URLS everything you can. Become the cat lady of software security. Use prepared statements. To: wang dot liang dot com at gmail dot com # My 2 cents: The idea of having two kind of database users could be good for certain purposes, BUT, what you are doing is only reducing the possibility of hacking in half. You STILL need to SECURE the other half of your queries. # My suggestion: SANITIZE user input, everything. Cookies, POST, GET, Headers, Files, URLS everything you can. Become the cat lady of software security. Use prepared statements. ANYONE READING HERE: Don't consider those suggestions please, you are only going to shoot yourself in the foot. ---- Server IP: 72.52.91.14 Probable Submitter: 189.173.203.196 ---- Manual Page -- http://php.net/manual/en/security.database.sql-injection.php Edit -- https://master.php.net/note/edit/120305 Del: integrated -- https://master.php.net/note/delete/120305/integrated Del: useless -- https://master.php.net/note/delete/120305/useless Del: bad code -- https://master.php.net/note/delete/120305/bad+code Del: spam -- https://master.php.net/note/delete/120305/spam Del: non-english -- https://master.php.net/note/delete/120305/non-english Del: in docs -- https://master.php.net/note/delete/120305/in+docs Del: other reasons-- https://master.php.net/note/delete/120305 Reject -- https://master.php.net/note/reject/120305 Search -- https://master.php.net/manage/user-notes.php