note 123313 added to mysqli.real-escape-string

I think two additional characters need to be removed or escaped to protect from injection: (accent grave) and ; (semicolon). Accent grave could be used to inject into table and key names, terminating them too early (if user input is allowed as table or key names), and semicolon could be used to insert additional statements into an SQL statement. Always use (accent grave) to surround table, key, and column names, and always use ' (apostrophe) to surround column values in SQL statements, especially if the names or values can ever contain spaces. ---- Server IP: 208.43.231.9 Probable Submitter: 98.2.238.89 ---- Manual Page -- http://php.net/manual/en/mysqli.real-escape-string.php Edit -- https://master.php.net/note/edit/123313 Del: integrated -- https://master.php.net/note/delete/123313/integrated Del: useless -- https://master.php.net/note/delete/123313/useless Del: bad code -- https://master.php.net/note/delete/123313/bad+code Del: spam -- https://master.php.net/note/delete/123313/spam Del: non-english -- https://master.php.net/note/delete/123313/non-english Del: in docs -- https://master.php.net/note/delete/123313/in+docs Del: other reasons-- https://master.php.net/note/delete/123313 Reject -- https://master.php.net/note/reject/123313 Search -- https://master.php.net/manage/user-notes.php