note 15828 deleted from function.mysql-escape-string by aidan
| From: | aidan@php.net | Date: | Wed, 11 Aug 2004 14:08:51 +0000 |
| Subject: | note 15828 deleted from function.mysql-escape-string by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-74458@lists.php.net to get a copy of this message | ||
Note Submitter: php@filecast.org
----
Actually, a hacker couldn't drop tables like that -- the PHP mysql_query only supports one
command per line. Of course, you should still escape everything coming from the outside world
because maliciously modifying the parameters of the intended command is still possible.