Prevention of SQL injection in PHP

Re:Prevention of SQL injection in PHP by duskwuff on Friday May 22, 2009 @07:43AM (#621872)

While we're at it: it also fails to understand the difference between addslashes() and mysql_escape_string(). (It's not just a matter of whether you're assigning the result to a variable or not!)

[ Parent | on HN ]

Re:Prevention of SQL injection in PHP by mildweed on Friday May 22, 2009 @09:32AM (#622014)

While you're still at it: get rid of the quotes entirely, just htmlentities( ) where appropriate.

[ Parent | on HN ]