SQL Question
Posted: 02 Aug 2009, 12:45
Hey! How do you stop SQL injection? In php the code is:
Code: Select all
$clean = mysql_real_escape_string($name_bad);
It is also important to note that we have used the _server.escapeQuotes() method to process each parameter coming from the client. The method fixes possible problems with quotes (') and double quotes (") that may cause SQL syntax errors.
In the sql statement all values to be insterted in the database are enclosed in single quotes('). If one of those values contains the same symbol the statement will be malformed and the command execution will fail. Always remember to use the escapeQuotes() method to avoid these problems.