Preventing mysql Injection - Printable Version

Preventing mysql Injection - Printable Version

+- SA-MP Forums Archive (https://sampforum.blast.hk)
+-- Forum: SA-MP Scripting and Plugins (https://sampforum.blast.hk/forumdisplay.php?fid=8)
+--- Forum: Scripting Help (https://sampforum.blast.hk/forumdisplay.php?fid=12)
+--- Thread: Preventing mysql Injection (/showthread.php?tid=618275)

Preventing mysql Injection - ReshiramZekrom - 03.10.2016

Hi.

How to prevent Mysql Injection?

I have to use mysql_escape_string() or I can simply do something like this:

PHP код:



format(Query, sizeof(Query), "SELECT * FROM `users` WHERE `Nome` = '%e'", name);

Thank you for the help

Re: Preventing mysql Injection - Stinged - 03.10.2016

Use %e with mysql_format, %q with format.

Re: Preventing mysql Injection - ReshiramZekrom - 03.10.2016

Quote:

Originally Posted by Stinged

Use %e with mysql_format, %q with format.

Using mysql_escape_string() it's the same thing of using %q instead of %s, right?