|
|
Posted by Roy Kaldung on 05/04/07 15:50
Iván Sánchez Ortega wrote:
> john wrote:
>
>> However, pulling out each variable from the $_POST array seems
>> awkward.
>
> Unless you program a framework just for that, it's the way to go.
>
>> The problem with constructing a string comes in due to the fact that
>> you often need to quote strings in the SQL statement
>
> You *always* have to quote strings in SQL.
I agree, but I'm proposing to use a database abstraction layer like PDO
in conjunction with prepared statements to avoid quoting input and
prevent SQL incjections.
hth,
Roy
Navigation:
[Reply to this message]
|