linux1880 Posted May 31, 2010 Share Posted May 31, 2010 Hello guys is this safe to insert values in database ? $sql="INSERT INTO table (field_1) values ('".$data['field_1']."')"; Link to comment https://forums.phpfreaks.com/topic/203458-is-it-safe-to-use-this-variable-to-insert-in-database/ Share on other sites More sharing options...
ignace Posted May 31, 2010 Share Posted May 31, 2010 No. Always use mysql_real_escape_string It's not because it was not entered by the user that it can't be harmful, it can still break your query. Link to comment https://forums.phpfreaks.com/topic/203458-is-it-safe-to-use-this-variable-to-insert-in-database/#findComment-1065877 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.