note 48915 deleted from security.database.sql-injection by tularis
| From: | tularis@php.net | Date: | Tue, 11 Jan 2005 23:33:17 +0000 |
| Subject: | note 48915 deleted from security.database.sql-injection by tularis | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-83110@lists.php.net to get a copy of this message | ||
Note Submitter: tino at infeon dot com
----
i always wrap any arguments in my query like this
<?php
mysql_query("SELECT * FROM
table WHERE row = '" .
addslashes($_REQUEST['argument']) . "'");
?>
even if row is a numeric field i still single quote and escape it.