|
Posted by Oli Filth on 09/27/98 11:37
ByteCoder said the following on 16/01/2006 12:11:
> Oli Filth <catch@olifilth.co.uk> wrote in
> news:%BLyf.35809$W4.22578@newsfe4-gui.ntli.net:
>
>> Incidentally, why are you storing stuff in your databases in a way
>> that requires stripslashes() to be called? Just store the raw text,
>> don't apply addslashes() or whatever to it.
>>
>>
>
> Thanks for the awnser. I do the addslashes and stripslashes because I
> want to prevent SQL injection attacks. (When inserting a value in a DB
> that was entered by a visitor).
addslashes() is not a fail-safe method for putting data into a MySQL
database. Use mysql_real_escape_string(), which is designed for this
purpose.
--
Oli
Navigation:
[Reply to this message]
|