|
Escape the inputs from quotes etc. first, for example with the mysql_real_escape() function, before you put them in an SQL query.
Courious too :P - And why are you storing a complete html tag? Why not just save the path and put it in an <img> tag your self when you need it? As in
UPDATE gpstable SET pic='/images/picture.jpg' WHERE id='3' LIMIT 1
The 'LIMIT 1' clause makes sure only 1 row is affected. So in case something goes bad, for exmaple if some jackass manages to make an SQL injection attack or similar and tries to screw thing up for you, it will still only affect one row instead of, lets say the whole table.
|