Re: Forms...and WHERE in mysql

..oO(jodleren)

Gee... I have been wondering whether the post can be in there, but
*just in case* I have always used it like this

$result=mysql_query("SELECT * FROM members WHERE username=\"".
$_POST["username"]."\"");
or
$result=mysql_query("SELECT * FROM members WHERE username=\"".
$_SESSTION["username"]."\"");

Strings in SQL are delimited with single quotes. And you _never_ want to
use a user-submitted value directly in a query without any validation.
Read about SQL injection.

Micha
.

Relevant Pages

  • Re: Need help with SQL injection proof recordset Update code
    ... attack is when you are dynamically building your one sql strings. ... quote with two single quotes by using the replace command. ...
    (microsoft.public.inetserver.asp.db)
  • Re: Need help with SQL injection proof recordset Update code
    ... attack is when you are dynamically building your one sql strings. ... quote with two single quotes by using the replace command. ... forget attempting to excape strings: ...
    (microsoft.public.inetserver.asp.db)
  • Re: SQL Injection with JDBC
    ... fixed SQL instead of building the SQL dynamicly. ... At most, they may have included clauses dynamically, but in my own experience that type of code is very messy to maintain, and one winds up selecting entire query strings based on user input, not building the strings up piecemeal. ... The thing that Arne say "should not be used in real-world projects" is non-parametrized, non-prepared statements where the SQL string is built up entirely in text then executed as such. ... The thing that we recommend is the use of PreparedStatement to embed type-safe parameters into SQL statements that are not subject to such flaws. ...
    (comp.lang.java.programmer)
  • Re: 3vl 2vl and NULL
    ... "strings" specifically are so interesting to you. ... input that can be cast to a numeric type, ... but it is not expected that the DBMS is forcing you to do so. ... It seems you can't accommodate the SQL outcomes because it doesn't have a "shape" that you are comfortable with. ...
    (comp.databases.theory)
  • Re: Trouble reading fields containing special characters
    ... Ah the Replace approach can open your application to SQL injection attacks. ... If you place your strings into query parameters, ... Any double single quotes in a string (all SQL strings are enclosed by single ... Microsoft MVP Scripting and ADSI ...
    (microsoft.public.vb.database.ado)