Reply to thread

Message: <blockquote data-quote="Janx" data-source="post: 6022566" data-attributes="member: 8835">ah yes, the dread apostrophe (or Single Quote).  That's actually  a risk for SQL Injection attacks, and should be addressed ASAP.EVERY field coming in from the screen that is incorporated into an SQL query should be run through a function to safety pad the value before it is concatenated to the query.  I cannot stress that enough.forex:$val = $POST["txtName"];$sql = "select * from Names where Name like '" + $val + ';"this means that I can type "';drop database YourDB; select '" into the txtName text box on the screen and get it to run my bit of SQL to drop your database, or something else.I'd have to look up the best recommendation for PHP, in general it's using a function like quotesmart() or just replacing all single quotes with a pair of single quotes.$val = quotesmart($FORM["txtName"]);To slobster, you can work around this bug by using a pair of single quotes:Janx's Great Spell -> Janx''s Great SpellWhen SQL sees a pair of single quotes, it realizes you mean to use a singlequote as content, and not signal the end of the single-quoted value.</blockquote>