|
|
Posted by Sanders Kaufman on 11/14/06 17:43
Christoph Burschka wrote:
> Indeed, SQL injection is a pretty big risk if you don't know about it,
> but it's very easy to prevent.
>
> Until you take the time to write a good validation function, the
> following two things should be safe enough:
> - Removing single ' quotes from the values
> - Setting an array of the parameter names you will use, and only iterate
> over these keys instead of all post parameters.
To get around this problem, without too much hassle,
I try to filter out all non alpha-numeric characters
submitted by users.
Do you know if there's any way to perform an SQL
injection attack with just [A-Za-z0-9]?
Navigation:
[Reply to this message]
|