NYCPHP Meetup

NYPHP.org

PHP DB security WAS: JavaScript List?

Hans Zaunere zaunere at yahoo.com
Fri Jul 19 18:36:15 EDT 2002


--- Jim Hendricks <jim at bizcomputinginc.com> wrote:
> work I have done in the past has been via ASP, JSP, and proprietary
> Java Servers in which multiple queries is not an option.  PHP is a
> newer technology for my company, and I was unaware that a PHP query
> could allow multiple queries in one statement.

As is the case with most PHP functionality [extensions], it's based on
the C API.  MySQL's core C API doesn't support multiple query strings
per query command (what DBs natively do now that I think about it?). 
As a result, you'll get a parse error at the ';' after trying to run
such a query string and then calling print mysql_error($db);

A problem, however, is leaving parameters out:

DELETE FROM atable WHERE id=''

or improper escaping:

DELETE FROM atable WHERE firstname LIKE '%'

As an aside, as I'm sure many have noticed, phpMyAdmin does support
multiple queries per "form box".  This is an application level feature
of phpMyAdmin.

HZ




__________________________________________________
Do You Yahoo!?
Yahoo! Autos - Get free new car price quotes
http://autos.yahoo.com



More information about the talk mailing list