note 34120 deleted from function.pg-escape-string by didou
| From: | didou@php.net | Date: | Wed, 16 Jul 2003 17:40:24 +0000 |
| Subject: | note 34120 deleted from function.pg-escape-string by didou | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-52216@lists.php.net to get a copy of this message | ||
Note Submitter:
----
Here with 'abc'efg' the middle ' terminates the string, however
'abc\'def' is one big string with a ' character in the middle.
If the user can terminate the string he can then put in the bad sql. When prompted for Barcode the
user could put in DROP TABLE foo; SELECT '1
$query = sprintf ("SELECT * FROM a.tblcards WHERE barcode='%s'",
pg_escape_string($barcode));
So you have to "clean" your variable coming in to prevent that.