Yup. And, if you're writing anything that talks to a database, use a parameterized statement (sometimes called a prepared statement) instead of just concatenati

Yup. And, if you're writing anything that talks to a database, use a parameterized statement (sometimes called a prepared statement) instead of just concatenating strings. You will blow it if you concatenate strings and that's what we call SQL injection.