Posted by www.gerardvignes.com on 12/26/06 16:08

I wrote a simple PHP function for handling string arguments to a SQL
Query:

function SqlEscapedQuotedString($unescaped_string) {
return '"' . addslashes($unescaped_string) . '"';
}

I never accept a SQL Query from the client, only an Argument to a SQL
Query on the server.

Gerard Vignes
http://www.GerardVignes.com
Seattle, WA

• Next in forum: MI5 Persecution: the BBC, television and radio
• Prev in forum: Re: Chage script for Linux servers?
• Thread view: Re: The best way to protect SQL injection?

[Reply to this message]