[MenaceX^]

Quote:

Originally Posted by ssǝן‾ʎ That code makes no sense and frankly won't work! You can't escape ALL of a query else it won't work - those characters are special for a reason. Also, I don't understand why you check for "INSERT", "SELECT" or "UPDATE" and assume they've lost connection if they didn't enter one of them, what if they've lost connection but did enter one of them? Or what if they're doing a "DROP" or "DELETE" or one of the many other types of query? If it was that simple to make queries secure, don't you think it would be built into SQL? Also, why MySQL and not SQLite, the default official database?

Well, I don't know much about SQLite and for now I'm ok with mysql .
Also, I could add more but I guess everyone has understood what the strcmp is supposed to do as it's a quick check for sql characters. You could just do ||strcmp(str,"DELETE")) or drop, w/e.