Technology Feed
Twitter
By Jason Slater
Wednesday, 30 April 2008
Wednesday, 30 April 2008
Sample code to avoid SQL injections using mysql_real_escape_string (http://uk.php.net/mysql_real_escape_string) which converts special characters to escape sequences to ensure they are suitable for submission to SQL
$mySQL = "UPDATE address SET postcode='.mysql_real_escape_string($postcode).' WHERE id='.mysql_real_escape_string ($account).'";
$myResult = mysql_query($mySQL);
Related
- Database Normalisation (Making Sense of Data) – 3NF Third Normal Form
- Finding the right self-host Blog platform – what are the options?
- Code Comments
- Shell Script: Random Number
- PHP: Web Service Feed Information
[...] would also be useful to use the mysql_real_escape_string in this instance to avoid SQL Injections. addthis_url = [...]