Comment on Use PHP to build a Twitter-like system on your siteparentComments−jonursenbach17ymysql_real_escape_string() _will_ protect you from code injection.- http://php.net/mysql_real_escape_string "Note: If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks."- http://www.php.net/manual/en/security.database.sql-injection...- http://www.metatitan.com/php/16/protecting-your-phpmysql-que...- http://en.wikibooks.org/wiki/Programming:PHP:SQL_Injection−Jem17yCODE injection, and SQL injection are two different things. I am talking about injecting malicious JavaScript etc - XSS attacks primarily.
Comments
mysql_real_escape_string() _will_ protect you from code injection.
- http://php.net/mysql_real_escape_string "Note: If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks."
- http://www.php.net/manual/en/security.database.sql-injection...
- http://www.metatitan.com/php/16/protecting-your-phpmysql-que...
- http://en.wikibooks.org/wiki/Programming:PHP:SQL_Injection
CODE injection, and SQL injection are two different things. I am talking about injecting malicious JavaScript etc - XSS attacks primarily.