note 43472 added to function.mysql-error
| From: | olaf at amen-online dot de | Date: | Tue, 22 Jun 2004 15:08:27 +0000 |
| Subject: | note 43472 added to function.mysql-error | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-71503@lists.php.net to get a copy of this message | ||
When dealing with user input, make sure that you use
<?php
echo htmlspecialchars (mysql_error ());
?>
instead of
<?php
echo mysql_error ();
?>
Otherwise it might be possible to crack into your system by submitting data that causes the SQL
query to fail and that also contains javascript commands.
Would it make sense to change the examples in the documentation for mysql_query () and for
mysql_error () accordingly?
----
Manual Page -- http://www.php.net/manual/en/function.mysql-error.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+43472
Delete -- http://master.php.net/manage/user-notes.php?action=delete+43472&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+43472&report=yes
Search -- http://master.php.net/manage/user-notes.php