4 ms·
It's been awhile since I used PHP but even if you're not using a framework I'm pretty sure you can just wrap your strings with mysql_escape_string or some simil
by MiddleEndian 10y ago
It's been awhile since I used PHP but even if you're not using a framework I'm pretty sure you can just wrap your strings with mysql_escape_string or some similarly named function.
- stormbrew 10y agoIt has also been a long time since I've used php, but when I did there were a few problems here. One is that mysql (opposed to oracle or pgsql) is kind of unusual in allowing quotes indiscriminately for all column types, so in order to do this right you have to only do it for string type columns and prevent injection on different types some other way. Another is that most of the APIs around the more sprintf-style quoting (eg: `query("SELECT * FROM table WHERE x = %", someStr);`) are tied into prepared statements, which carry their own problems that also differ per engine. It's actually not as simple as you might think. On top of that, php used to have the whole automatic quoting thing that just made a hash out of things.
- krapp 10y ago>I'm pretty sure you can just wrap your strings with mysql_escape_string or some similarly named function Prepared statements have been a thing in PHP for a long time, now. Concatenating strings into SQL queries is no longer ever the right answer.