SQL injection in PHP, sprintf and numerical values -
this question has answer here:
- how can prevent sql injection in php? 28 answers
i'm trying make queries safe sql injection , luckily, variables targeted integers or floats, wondering if, in case, enough use sprintf() (not using mysqli_real_escape_string()). made few tests, , moment looks good, since parses input float/integer, no sql statement should executed. there way hack this? looks easy , wonderful me :d
why don't use prepared statements? give better protection fron sql injection plus may improve query performance if reused.
Comments
Post a Comment