Parameterized Queries

Forum Moderators: coopster

Message Too Old, No Replies

Parameterized Queries

HoboTraveler

7:00 am on Oct 6, 2006 (gmt 0)

Hi All,

I've been reading that magic quotes, addslashes and everything else related to escaping slashes are not the best to create secure queries.

There is an example on this page that shows a parameterized query or bound parameter. However, the demo is for Java.

Could someone please point me on how to create such a query using PHP4/MySQL..

[unixwiz.net...]

I suppose the bound statements could be used for INSERT, SELECT, UPDATE etc..

TIA

barns101

10:05 am on Oct 6, 2006 (gmt 0)

This is not my area of expertise but as far as I am aware, you need to add slashes and also use mysql_real_escape_string [php.net].

eelixduppy2

10:49 am on Oct 6, 2006 (gmt 0)

Here's the documentation on Database Security [us2.php.net]

coopster

7:43 pm on Oct 9, 2006 (gmt 0)

MySQL bound statements, or prepared statements, are addressed in PHP5 with the MySQL Improved Extension [php.net]. Prior to that you'll have to write your own class or perhaps you can locate one at PEAR or phpclasses.