Re: Lazy sanitizing of data for SQL queries

Hi,

Sverre:

I work with PHP and validate non-textual columns with is_numeric().

Phill:

Lots of good points there. When I thought of this I was writing a small script to allow users to post comments under topics on a documentation system. I'm using base64 for the topic title and body, which (unless I add search functionality) is never queried, other than to retrieve it. You're quite right though that this wouldn't work for anything beyond the very basic!

HarryM Received on Fri Jan 24 16:00:24 2003