Re: SQL injection - mysql_real_escape_string()?
| From: | Ariz Jacinto | Date: | Mon, 13 Feb 2012 06:06:49 +0000 |
| Subject: | Re: SQL injection - mysql_real_escape_string()? | ||
| References: | 1 | Groups: | php.windows |
| Request: | Send a blank email to php-windows+get-30772@lists.php.net to get a copy of this message | ||
Hi Jacob,
Yes, you need to do more than just using mysql_real_escape_string()
solely. I recommend the book "SQL Antipatterns: Avoiding the Pitfalls
of Database Programming" by Bill Karwin
http://www.amazon.com/SQL-Antipatterns-Programming-Pragmatic-Programmers/dp/1934356557