5 ms·
Escape the quote. See http://en.wikipedia.org/wiki/SQL_injection#Preventing_SQL_injection http://en.wikipedia.org/wiki/SQL_injection#Preventing_SQL_in...
by smackjer 17y ago
Escape the quote. See http://en.wikipedia.org/wiki/SQL_injection#Preventing_SQL_injection http://en.wikipedia.org/wiki/SQL_injection#Preventing_SQL_in...
- tptacek 17y agoEscaping will get you killed. Do you know what %u2032 means? +ACc-? %ef%bd%b1? Parameterize the query.
- brlewis 17y agoIgnoring the part about PHP not knowing the difference between a byte and a character...%2032? There are databases where something other than ASCII single quote will terminate a string?
- tptacek 17y agoSure. It depends on the database, the way the query is constructed, and the way the handle is initialized. But the bigger problem is what the web stack does to the query before it hits the database. People have been playing charset games to get past SQL quoting for almost 10 years now, and not just in PHP.