Quote:
Originally Posted by AdultKing
It isn't necessarily your use of mysql_query that is your problem in getting the right results from your SQL query , but it's good practice to set up the query first and make sure you escape all input and then submit the query.
Are you getting the output you want now ? I checked your website and it's still not returning matches for any word in the query.
|
I see what you are saying. Using prepared statements and then executing with escaped input helps against SQL Injection.
No, Still not working. But I want to try using parameterized SQL now. Kind of difficult to find good examples of the correct way to do things and too much old code on the internet.