28.11.2009, 10:02
Oh ok, I understand half of that I think. Does it mean that players could for example type DROP table blablabla as 'value' and then that table would be deleted? And the escape thing is supposed to prevent players from typing that? If that's all it's not a big problem because only value has to be Numeric. But is there any other reason why I should use escape string? Can people 'inject' in another way?