Nov 3 2014, 08:26 PM, updated 12y ago
Read these:
http://en.wikipedia.org/wiki/SQL_injection
http://php.net/manual/en/mysqli-stmt.bind-param.php
http://php.net/manual/en/security.database.sql-injection.php
TL/DR:
Don't do this:
CODE
$mysqli->query("UPDATE table Foo set body= '".$_POST['body']."' where id= '".$_POST['id']."'");
Do this (well, a *better* version of this):
CODE
$stmt = mysqli_prepare($link, "UPDATE table Foo set body = ? where id= ?");
mysqli_stmt_bind_param($stmt, 'sd', $_POST['body'], $_POST['id']);
mysqli_stmt_execute($stmt);
mysqli_stmt_bind_param($stmt, 'sd', $_POST['body'], $_POST['id']);
mysqli_stmt_execute($stmt);
This post has been edited by angch: Nov 3 2014, 08:28 PM
Quote
0.0151sec
0.66
6 queries
GZIP Disabled