Preventing SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

I have a question about SQL Injection, In some of our code we use this: view plaincopy to clipboardprint?Replace(inString, "'", "''") Replace(inString, "'", "''") does this prevent all forms of SQL Injection? Also what exactly does parameterized statements do?view plaincopy to clipboardprint?myCommand.Parameters.AddWithValue("@username", user); myCommand.Parameters.AddWithValue("@password", pass);

Your Answer:

Login to answer

Other forums

array_map() probably obvious mistake
The code below is part of a class to escape strings, but should also accept an array, using array_ma

onClick='location.href=index.htm'> not working
Below is my code:

echo "<input type='button' value='redirect' onClick='location.h

Read from forum
Haven't written anything forever and I would like to get back.
What I'm trying to do is getting t

ob_ dynamic content
i was wondering about the potential to use ob to create a <div then remove it when the page

mysql timestamp manipulation
How could I use a timestamp (e.g 2009-10-30 13:20:35 ), and with php find out if it is:

from

Is this possible? If one file assigned to an ID...
I have a page that lists property listings assigned to a specific user (a manage page), with brief t

Help with form post data and arrays
Hi all,

I am new to this forum... It has been awhile since i have worked with arrays, and i a

Inserting the current date/time while submitting the forum
What do I need to add below to update the current date/time? I have a field in the database called d

System copy error in RUN ABAP REPORT PHASE
Hi,
I am performing system copy on my test server. I have previously taken export of JAVA + A

Format String help
I have a textbox where a person enters an application number. the application number is 10 characte