4 ms·
I disagree. See Example 5 in https://www.php.net/manual/en/security.database.sql-injection.php https://www.php.net/manual/en/security.database.sql-injectio...
by richardwhiuk 7y ago
I disagree.
See Example 5 in https://www.php.net/manual/en/security.database.sql-injection.php https://www.php.net/manual/en/security.database.sql-injectio...
This is the recommended way to avoid SQL injection, using sprintf...
- wolco 7y agoSo bad docs because they list a way you don't approve of? They do list a number of different ways. They could have used intval() for example 4 because I prefer it but it doesn't take away from the docs or make them bad. Do you have a method that makes sprintf with d value invalid?
- jontro 7y agoThe article states this as the second bullet point "Use prepared statements with bound variables." Reading the page I actually think this is pretty good for being language documentation.