PHP DB security WAS: JavaScript List?
Hans Zaunere
zaunere at yahoo.com
Fri Jul 19 18:36:15 EDT 2002
--- Jim Hendricks <jim at bizcomputinginc.com> wrote:
> work I have done in the past has been via ASP, JSP, and proprietary
> Java Servers in which multiple queries is not an option. PHP is a
> newer technology for my company, and I was unaware that a PHP query
> could allow multiple queries in one statement.
As is the case with most PHP functionality [extensions], it's based on
the C API. MySQL's core C API doesn't support multiple query strings
per query command (what DBs natively do now that I think about it?).
As a result, you'll get a parse error at the ';' after trying to run
such a query string and then calling print mysql_error($db);
A problem, however, is leaving parameters out:
DELETE FROM atable WHERE id=''
or improper escaping:
DELETE FROM atable WHERE firstname LIKE '%'
As an aside, as I'm sure many have noticed, phpMyAdmin does support
multiple queries per "form box". This is an application level feature
of phpMyAdmin.
HZ
__________________________________________________
Do You Yahoo!?
Yahoo! Autos - Get free new car price quotes
http://autos.yahoo.com
More information about the talk
mailing list