Quote:
Originally Posted by KlenTelaris
You mean something like this ?
PHP Code:
$sql = "UPDATE table SET column='$_POST[bla]'";
|
Yes, do not ever do that :P Imagine if the value of $_POST['bla'] was something like...
'; DROP DATABASE 'XXXXX
Byebye data... SQL injection FTL.
Check out
http://us.php.net/manual/en/mysqli.r...ape-string.php