Re: DataGrid and DataObject->whereAdd()
| From: | Alan Knowles | Date: | Sat, 25 Dec 2004 01:13:43 +0000 |
| Subject: | Re: DataGrid and DataObject->whereAdd() | ||
| References: | 1 2 3 | Groups: | php.pear.general php.pear.general |
| Request: | Send a blank email to pear-general+get-16461@lists.php.net to get a copy of this message | ||
Yes: $DO->whereAdd($searchField . ' like \'%' . $_GET[$searchField] . '%\'');WARNING:WARNING:WARNING:WARNING:WARNING:WARNING:WARNING:WARNING:WARNING:WARNING:WARNING: You should always escape form data going into whereAdd.. eg. $DO->whereAdd($searchField . ' like \'%' . $DO->escape($_GET[$searchField]) . '%\''); WARNING:WARNING:WARNING:WARNING:WARNING:WARNING:WARNING:WARNING:WARNING:WARNING:WARNING: Regards Alan
Thanks, Rodrigo.-- Justin Patrin