Re: anti SQL injection method in php manual.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 5/26/06, Satyam <Satyam@xxxxxxxxxxxxx> wrote:> The escaping of invalid characters is already included and beside, you can> simplify your SQL statements such as the example (taken from the phpdocs> header).>> echo BuildSql('Insert into ?ttable> (?s,?ns,?mi,?d,?ni,?i)','Something','',5,time(),0,null);>> will return:>> Insert into wp_table ('Something',null,5,'2006-05-15',null,0)>> So, as you see, it will handle date conversion from internal PHP to SQL, it> will quote and escape strings, it will either use null or 0 o '' according> to formatting options and it will add the contents of the $table_prefix> variable wherever you put a ?t.  It spares you a lot of trouble on the whole> SQL instruction, not just on escaping every individual field.>> And you don't need to check the code, just read the comments, that's why I> bothered putting them there.>> Satyam
Of course I read through the comments and the code. However I am nomaintenance programmer and without a real idea of what the code wastrying to acomplish, I couldn't fathom why it was doing what is wasdoing. Once again, that's not criticism- it's me trying to learn.
I think that it is a little involved for what I'm currently doing, butI will certainly save the code for use when I'm more skilled. I mostappreciate your help. Thanks!
Dotan Cohenhttp://what-is-what.com41

[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux