Steve Freitas <[EMAIL PROTECTED]> wrote: > > Do y'all feel that using htmlEncode() on incoming data to be included in a > SQL query is an effective solution to that problem?
No. As you noted, it's useful for preventing HTML markup in input from affecting the rendering of an HTML page. To protect against SQL injection attacks, do SQL-escaping. The precise characters you need to worry about depend on what RDBMS you use, but '"', "'", and ";" are the common ones. Charles -- ----------------------------------------------------------------------- Charles Cazabon <[EMAIL PROTECTED]> GPL'ed software available at: http://www.qcc.ca/~charlesc/software/ ----------------------------------------------------------------------- ------------------------------------------------------- Sponsored by: ThinkGeek at http://www.ThinkGeek.com/ _______________________________________________ Webware-discuss mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/webware-discuss
