|
Posted by Tim Van Wassenhove on 12/26/06 13:42
Alucard schreef:
> Hi all.
>
> I would like to ask if Regular expression is the best way to deal with
> SQL injection attack, and no mysql_real_escape_string() is used:
Imho there are two things you have to take care of:
1) Validate user input (a regular expression can be used)
2) Prepare the data for use in a MySQL query (mysql_real_escape_string
can be used for but these day's i'd opt for parameter binding instead...)
--
Tim Van Wassenhove <url:http://www.timvw.be/>
Navigation:
[Reply to this message]
|