Hello,
Is this good for preventing mysql injections?
$sql = 'INSERT INTO table (value1,value2,value3,date)';
$sql .= 'VALUES ('.$conn->qstr($value1).','.$conn->qstr($value2).','.$conn->qstr($value3).',NOW())';
if($conn->Execute($sql) === false) {
print 'error inserting: '.$conn->ErrorMsg().'';
}
or
$recordSet = &$conn->Execute('SELECT * FROM table WHERE id = '.$conn->qstr($id).' LIMIT 1');
Thanks In advance, |
