Quote:
Originally Posted by CrazeD  As it is only a basic tutorial, I didn't do much with security. However, mysql_escape_strings will pretty much eliminate SQL injection, by escaping any illegal characters. If you wanted to take it a bit further, you could use some regex to custom filter the data before you do any queries. |
i did a quick search and found the following thread. The posters say mysql_real_escape_strings is more secure.
I'm wondering if it would be possible to run subqueries. i think you need parathenses.
PHP Code - Help Needed - Dev Shed
edit - here's a read for ya
Reviewing Code for SQL Injection - OWASP