Preventing SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

I have a question about SQL Injection, In some of our code we use this: view plaincopy to clipboardprint?Replace(inString, "'", "''") Replace(inString, "'", "''") does this prevent all forms of SQL Injection? Also what exactly does parameterized statements do?view plaincopy to clipboardprint?myCommand.Parameters.AddWithValue("@username", user); myCommand.Parameters.AddWithValue("@password", pass);

Your Answer:

Login to answer

Other forums

Frustrated php Newbie
First off, I am pretty much a PHP nub. I can read and understand the language (most of the time) so

Undefined index: username HELP NEWBIE
I am trying a simple login/logout for my website. It works well with checking if the username exists

Extra fields in main body and php required.
I'm new to PHP so please be gentle. I have a little php script below that works well.
The &quo

php or sql?
Sorry not sure if this is a sql problem or php the following code is supposed to delete data from th

Storing user data help?
Hey Guys,

I'm not use if this question is to broad but I can always give you more informatio

Finding digits in variable containing text, and IDing them
$romanstock = "http://www.remoteprice.com/data.asp?storeid=123&itemcode=456&typ

Edit MySQL Row Using PHP and HTML Form
Hello,

Here's what I'm trying to do. Build a page where a user enters a MySQL row number in.

Multipe Dynamic Controls & AutoPostback Issue
I currently have a need to create many dynamic controls (Example Textboxes) that need to do a PostBa

Having Problem with Date
l have a submit buttom where user have the possibility to add a date to specify when his message s

Extracting Long text from message class with parameters
Hi,

I would like to extract the long text from a message class. However, the long text ha