PEAR::DB 1.6.4 problem with quoteSmart()
| From: | Torsten Roehr | Date: | Wed, 30 Jun 2004 17:58:35 +0000 |
| Subject: | PEAR::DB 1.6.4 problem with quoteSmart() | ||
| Groups: | php.pear.general | ||
| Request: | Send a blank email to pear-general+get-13420@lists.php.net to get a copy of this message | ||
Hi,
I've got a problem with quoteSmart() in PEAR::DB 1.6.4:
I've got the following query:
$query = "SELECT * FROM table WHERE userName = '" . $db->quoteSmart($user) .
"' AND password = '" . md5($password) . "'";
Which creates the following statement:
SELECT * FROM table WHERE userName = ''user'' AND password = 'xyz'
This of course causes an error because of the two single quotes around user.
Why does quoteSmart() return the string enclosed in quotes?
Of course it's easy to solve by not putting quotes around my value in the
query manually. But isn't it the responsibility of the application/developer
to decide if a value should be put between quotes or not in the query!?!
This has nothing to do with escaping quotes within the value.
Any ideas on this?
Thanks and best regards,
Torsten Roehr