SQL injection in PHP, sprintf and numerical values -


this question has answer here:

i'm trying make queries safe sql injection , luckily, variables targeted integers or floats, wondering if, in case, enough use sprintf() (not using mysqli_real_escape_string()). made few tests, , moment looks good, since parses input float/integer, no sql statement should executed. there way hack this? looks easy , wonderful me :d

why don't use prepared statements? give better protection fron sql injection plus may improve query performance if reused.


Comments

Popular posts from this blog

monitor web browser programmatically in Android? -

Shrink a YouTube video to responsive width -

wpf - PdfWriter.GetInstance throws System.NullReferenceException -