COOKIE and SQL Injection

**PHPBoy** · Jun 30, 2005 07:38

Hello ..

for example :

PHP Code:


$query = mysql_query("SELECT * FROM table WHERE username='" . $_COOKIE['username'] . "'");

magic_quotes is off , what is solution ?

**pixelsoul** · Jun 30, 2005 07:50

http://nl3.php.net/manual/en/functio...ape-string.php

Note that you can use a function where you check wether magic quotes is on or off, and escape if necessary..

**PHPBoy** · Jun 30, 2005 08:09

thanks but what about addslashes ?

**Czaries** · Jun 30, 2005 09:34

You do not need addslashes when using that function - it will take care of everything for you.

User Tag List