Posted by Michael Fesser on 11/26/07 16:49

..oO(Michael Martinek)

>mysql_real_escape_string will not change $nAccountID from the value of
>"0; DROP users;".. there's nothing to be escaped in the string. The
>proper way to protect against SQL injection is usually a combination
>of sprintf() or intval(), and mysql_real_escape_string().

Or prepared statements.

Micha

[Back to original message]