|
Posted by Jerry Stuckle on 12/19/06 13:56
howa wrote:
>>3: if so, what is the best practices to protect my database/site ?
>>
>
>
>
> Two simple rules to prevent SQL injection (MySQL)
>
> 1. if the input data is string, escape the quote
>
> e.g.
>
> this is "dsds => this is \"dsds
>
Which does not work with all character sets. Better is to use
mysql_real_escape_string().
> 2. if the input data is integer, make sure it is really integer and
> never contains characters
>
> e.g. i = intval(i); // force integer
>
--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================
Navigation:
[Reply to this message]
|