note 15796 deleted from function.mysql-escape-string by aidan
| From: | aidan@php.net | Date: | Wed, 11 Aug 2004 14:08:56 +0000 |
| Subject: | note 15796 deleted from function.mysql-escape-string by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-74459@lists.php.net to get a copy of this message | ||
Note Submitter: jeroen@php.net
----
Usage:
<?php
$name = mysql_escape_string( $name );
$query = "SELECT * FROM adresses WHERE name='$name' AND private='N'";
mysql_query($query);
?>
Without mysql_escape_string a user could set name to "' OR 1=1 OR
''='"
effectively leading to the query:
SELECT * FROM adresses WHERE name='' OR 1=1 OR ''='' AND
private='N'
which will give all adresses, including private ones.
Don't say people won't find out, very ofter query errors are displayed to the user, and
also this is such a common mistake that hackers will simply GUESS things like this.