Re: PHP for preventing SQL injections?

[Gavin Zuchlinski <gzuchlinski () pgsit org>]

Variables in SQL statements are not always quoted themselves, so just slashing 
out quotes for everything wont always work (like with integers). So like you 
said you need to consider how it will be handled, relying on addslashes() for 
everything or magic quotes just wont cut it. But there is a whole big scary 
world out there beyond this, SQL injection is only the front door.

-Gavin Zuchlinski
http://libox.net/


On Tuesday 16 September 2003 08:43 pm, latte () hushmail com wrote:
> I don't see anything in there that contradicts what
> I said ...
>
> Escaping quotes [in mssql] is all you need to do when
> using strings in any SQL, and when using other datatypes
> you just need to consider how they are handled by
> your server (i.e. numbers, dates) so that are fixed
> for any special characters as well (which is what I said).
>
> What is wrong with that ?