Posted by R. Rajesh Jeba Anbiah on 12/18/34 11:50

howachen@gmail.com wrote:
> Hi,
<snip>
> However, another form of SQL injection might in the form of...
>
> /**********************************************************/
> $name = "1 UNION blah blah blah"
> $query = "SELECT * FROM users WHERE id = ".$name;
> /**********************************************************/
>
> for case 1, we can easily solved by escaping the special characters
> like " ' ", but how to solve for case 2?

Use prepared statements. FWIW,
<http://ilia.ws/archives/103-mysql_real_escape_string-versus-Prepared-Statements.html>

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/

[Back to original message]