Posted by Toby A Inkster on 07/18/07 08:21

J.O. Aho wrote:

> $query("UPDATE tablename SET column1='{$_REQUEST['column1']}',
> column2='{$_REQUEST['column2']}', column3='{$_REQUEST['column3']}' WHERE
> keycolumn='{$_REQUEST['keycolumn']}'";

Argh!

$query = sprintf("UPDATE tablename"
." SET column2='%s', column3='%s'"
." WHERE column1='%s';"
,mysql_real_escape_string($_REQUEST['column2'])
,mysql_real_escape_string($_REQUEST['column3'])
,mysql_real_escape_string($_REQUEST['column1'])
);

--
Toby A Inkster BSc (Hons) ARCS
[Geek of HTML/SQL/Perl/PHP/Python/Apache/Linux]
[OS: Linux 2.6.12-12mdksmp, up 27 days, 11:55.]

PHP Linkifier
http://tobyinkster.co.uk/blog/2007/07/18/linkify/

[Back to original message]