3 ms·
You should use bind variables instead of directly inserting php variables in your SQL. You're just opening yourself up for SQL injection. >> WHERE poll_id != '$
by tayl0r 16y ago
You should use bind variables instead of directly inserting php variables in your SQL. You're just opening yourself up for SQL injection.
>> WHERE poll_id != '$poll_id'
- jawns 16y agoThe post explicitly notes that the query, as presented, is not necessarily secure and is merely meant to give the reader the gist of what's going on. However, in Correlated's case, it's not really an issue, because SQL injection is only a problem when $poll_id is a user input. But this particular query is only run by a user-inaccessible script.