note 35217 added to function.mysql-real-escape-string
| From: | Stuph at rack1 dot php dot net | Date: | Sat, 23 Aug 2003 18:42:31 +0000 |
| Subject: | note 35217 added to function.mysql-real-escape-string | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-54970@lists.php.net to get a copy of this message | ||
Putting quotes around numbers is silly/wrong.
fix/eliminate the problem before it gets to *SQL:
$new_num = intval( $_POST['new_num'] );
----
Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php
Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+35217
Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+35217&report=yes
Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+35217&report=yes