Posts: 3,985
Name: Abel Mohler
Location: Asheville, North Carolina USA
|
mysql_real_escape_string (in PHP) is for filtering any public string (like in the url). By filter, I mean it removes any attempt at adding a SQL statement into a string.
Example (assume url website.com/?page=homepage):
PHP Code:
$clean = mysql_real_escape_string($_GET["page"]);
//now this string will not contain a SQL injection and may be used in a query.
$sql = "select * from content where page='$clean'";
$result = mysql_query($sql);
If this wasn't done, anyone could do something like this:
website.com/?page=homepage and ''=''
which would dump the whole database, depending on how the rest of the page is programmed. There are also a whole string of things that could be done to read things from the database, just depending on what is going on with your code. To be on the safe side, it is always a good idea to filter data you don't have 100% control over. |
