linux1880 Posted May 31, 2010 Share Posted May 31, 2010 Hello guys is this safe to insert values in database ? $sql="INSERT INTO table (field_1) values ('".$data['field_1']."')"; Quote Link to comment Share on other sites More sharing options...
ignace Posted May 31, 2010 Share Posted May 31, 2010 No. Always use mysql_real_escape_string It's not because it was not entered by the user that it can't be harmful, it can still break your query. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.