|
Posted by Malcolm Dew-Jones on 11/04/05 18:51
Chung Leong (chernyshevsky@hotmail.com) wrote:
: Malcolm Dew-Jones wrote:
: > Definitely correct, but escaping is not the same as using intval to force
: > something into a number. Escaping is the mechanism to ensure that the
: > database (or whatever) sees and stores the original data in its original
: > format.
: Well, how else do you safely insert an integer into a SQL statement?
insert into Tbl (my_col) values (?)
and then bind the statement to the value.
--
This programmer available for rent.
Navigation:
[Reply to this message]
|