|
Posted by Alucard on 12/26/06 11:50
Hi all.
I would like to ask if Regular expression is the best way to deal with
SQL injection attack, and no mysql_real_escape_string() is used:
if(preg_match("[A-Za-z0-9](4,6)")){
print "Success!";
}
In the above example, only character and digit are allowed. Other
injection technique is no used.
Is it correct? Did I make any foolish assumptions or mistakes? Please
let me know.
Thank you very much.
Navigation:
[Reply to this message]
|