note 124822 deleted from mysqli.examples-basic by cmb
| From: | cmb@php.net | Date: | Sat, 26 Dec 2020 10:50:09 +0000 |
| Subject: | note 124822 deleted from mysqli.examples-basic by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-216018@lists.php.net to get a copy of this message | ||
Note Submitter: Eric D
----
Concatenating variables directly into a SQL statement is a huge anti-pattern that is likely to
introduce a SQL injection exploit.
MySQLi includes prepared statements, which allow you to safely pass variable data to a SQL query: https://www.php.net/manual/en/mysqli.prepare.php
For more information on SQL Injection exploits please consult OWASP: https://owasp.org/www-community/attacks/SQL_Injection