Preventing SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

I have a question about SQL Injection, In some of our code we use this: view plaincopy to clipboardprint?Replace(inString, "'", "''") Replace(inString, "'", "''") does this prevent all forms of SQL Injection? Also what exactly does parameterized statements do?view plaincopy to clipboardprint?myCommand.Parameters.AddWithValue("@username", user); myCommand.Parameters.AddWithValue("@password", pass);

Your Answer:

Login to answer

Other forums

Splitting Attributes
SQL> SELECT I_NAME, substr(I_NAME,1,instr(I_NAME,'O')) "First part",

substr(I_NAME, IN

having a small php error tha deals with the 'foreach'
Last night i was working on a script for a cart and it seemed to working good, until this morning. F

DataTable Help Required
Hi all I am creating an app that utilises and MS Access back end and queries it quite a bit at vario

'grab_files', multiple extension?
hey guys,

can anyone suggest a way to make to following line of code look for files with more

Creation of Raw Exposure manually
SAP Gurus

I am creating Raw Exposure ( Hedge management ) thru T Code TEM10 with followin

Need help making a script that moves data into acrhive table
Hi,

I'm kinda new to php/mysql

And i wrote a simple script to store sales lead for a b

Got A Free Server :(
So I was given a free server

http://shopping.yahoo.com/p:Compaq%20ProLiant%201500%20Server:1

help with contest script
I would like to code a contest script to my site but i don't know how. Could someone just give me pu

From Header Showing 'Unkown' In Hotmail? Why?
Code: $to = $row_GetID['email_addr'].',sales@mywebaddress.co.uk';
$subject = 'Thank you for you

Time script, set to my time zone?
I am using this line to get the date and time

Code: $time = date(F." ".d.", &q