note 17221 rejected from function.mysql-query by zak
| From: | zak@php.net | Date: | Fri, 30 Nov 2001 05:37:32 +0000 |
| Subject: | note 17221 rejected from function.mysql-query by zak | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-21471@lists.php.net to get a copy of this message | ||
I've read a lot of stuff about not trying
mysql_query("select * from whatever where id=$userinput");
because the user may be evil and instead of a valid (usually numerical) input he may submit
something similar to "3; drop database mysql" or whatever.
Did anybody actually try this at home? Or is this just a myth? I tried it home and it just issues an
error - apparently mySQL expects a single query and coughs it out if there's more than one
query in there. On the other hand it may be that I'm using PHP4 and that's why it's
not working? And it was working on PHP3?
Can anyone confirm that?