note 34120 added to function.pg-escape-string

Here with 'abc'efg' the middle ' terminates the string, however 'abc\'def' is one big string with a ' character in the middle. If the user can terminate the string he can then put in the bad sql. When prompted for Barcode the user could put in DROP TABLE foo; SELECT '1 $query = sprintf ("SELECT * FROM a.tblcards WHERE barcode='%s'", pg_escape_string($barcode)); So you have to "clean" your variable coming in to prevent that. ---- Manual Page -- http://www.php.net/manual/en/function.pg-escape-string.php Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+34120 Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+34120&report=yes Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+34120&report=yes