| List: | General Discussion | « Previous MessageNext Message » | |
| From: | Dotan Cohen | Date: | September 19 2011 11:23pm |
| Subject: | Re: Quotes around INSERT and SELECT statements' arguments from the mysql CLI and PHP | ||
| View as plain text | |||
On Tue, Sep 20, 2011 at 01:48, Reindl Harald <h.reindl@stripped> wrote: > i would use a samll class holding the db-connection with insert/update-methods > pass the whole record-array, lokk what field types are used in the table > and use intval(), doubleval() or mysql_real_escape-String > By the way, the database connection is include()ed from a file outside the webroot. This way if Apache is ever compromised or for whatever reason stops parsing the PHP, the resulting code returned to the browser won't have the daabase info (especially the password). -- Dotan Cohen http://gibberish.co.il http://what-is-what.com