Safe way to escape form variables to insert in sql (to oracle)

Hi,

I'm connecting to a oracle db via ODBC (can't use native oracle functions) and i need to parse the input from a form to insert in a sql query.

I know the dangers of that so i want to be extra sure i "escape" all strange chars.

I would like to know if using placeholders is enough or should i do something else (maybe addslashes, htmlspecialentities, etc) to have safe queries without strange chars (maybe removing % and _ also, because they have special meaning in oracle).

The code i'm using right now is something like this:

$desc = $_POST['desc'];
$sql = "select id from photo where desc LIKE '?'";
$res = odbc_exec($conn, $sql, $desc);

Is this 100% safe or should i do anything more to secure it?


Thanks in advance,
ATK
.

Relevant Pages

  • Re: Statspack Help Please
    ... High logical reads probably points to badly untuned SQL ... >Module: JDBC Thin Client ... >Notice that the Parse & Executions are mostly the same. ... Sybrand Bakker, Senior Oracle DBA ...
    (comp.databases.oracle.server)
  • Re: Statspack Help Please
    ... > Shared Pool Size: 112M Log Buffer: 512K ... > Notice that the Parse & Executions are mostly the same. ... Cost Based Oracle: Fundamentals ...
    (comp.databases.oracle.server)
  • Unnecessary calls to DBMS_DESCRIBE Oracle Stored procedure
    ... I have utilized Microsoft Activex Data Object 2.6 library to call some Oracle ... It actually happens when we are calling the stored procedures that are going ... The problem is supposed to be fixed in the Oracle 9.2 provider... ... The parse stat count is being incremented twice, ...
    (microsoft.public.data.ado)
  • Cannot Insert into Oracle
    ... I'm trying to insert into an oracle db. ... connection it seems, I can retrieve records from the db just fine. ... the line with the regex in it is just to parse the text file so ...
    (perl.dbi.users)