Re: Framework Development (2)
| From: | Ondrej Jombik | Date: | Sun, 16 Jun 2002 09:45:12 +0000 |
| Subject: | Re: Framework Development (2) | ||
| References: | 1 | Groups: | php.pear.dev |
| Request: | Send a blank email to pear-dev+get-7064@lists.php.net to get a copy of this message | ||
> if ($this->allowedfields != '')
> {
> if (in_array($key, $this->allowedfields))
> {
> $sqlst .= "'".$value."', ";
> }
> }
> else
> $sqlst .= "'".$value."', ";
> if ($this->allowedfields != '')
> {
> if (in_array($key, $this->allowedfields))
> {
> $sqlst .= $key." = '".$value."'".', ';
> }
> }
> else
> $sqlst .= $key." = '".$value."'".', ';
You are not escaping SQL values. It is not neccessary?
=Nepto=
____________________________________________________________________________
Ondrej 'Nepto' Jombik, http://www.nepto.sk/
nepto@atomicpile.sk