Re: Re: DB wildcards
| From: | Danny Brow | Date: | Tue, 17 May 2005 16:42:34 +0000 |
| Subject: | Re: Re: DB wildcards | ||
| References: | 1 2 3 | Groups: | php.pear.general |
| Request: | Send a blank email to pear-general+get-19248@lists.php.net to get a copy of this message | ||
On Mon, 2005-05-16 at 09:18 +0200, Massimiliano Arione wrote:
> Greg Beaver wrote:
>
> > If you're grabbing $field from external input, the system you're using
> > is dangerous - I would recommend being much stricter:
>
> Why dangerous?
> The DB provides atuomating quote and escape of values putted in
> placeholfers.
Because some one can do an sql injection attack. I get this warning
every time I post a question, but either I've removed the extra code to
make it easier to read or have not yet started to make my code secure.
Dan.