|
|
Posted by howachen on 10/11/11 11:49
Hi,
In many web articles, people focusing on SQL injection in the form of :
e.g.
/**********************************************************/
$name = "tom' UNION blah blah blah"
$query = "SELECT * FROM users WHERE name = '".$name."';
/**********************************************************/
However, another form of SQL injection might in the form of...
/**********************************************************/
$name = "1 UNION blah blah blah"
$query = "SELECT * FROM users WHERE id = ".$name;
/**********************************************************/
for case 1, we can easily solved by escaping the special characters
like " ' ", but how to solve for case 2?
Thanks.
Navigation:
[Reply to this message]
|