sosamv
Posts: 50
|
| Posted: 01/19/2009, 2:22 PM |
|
CCGetParam is safe against code injection?
example:
$db->query("select * from tblcars where ID_Car =".CCGetParam("ID_Car",""));
Thanx
|
 |
 |
sosamv
Posts: 50
|
| Posted: 01/20/2009, 3:45 PM |
|
anyone? hehe
|
|
|
|
damian
Posts: 838
|
| Posted: 01/20/2009, 8:01 PM |
|
you've seen how others have done their testing....
_________________
if you found this post useful take the time to help someone else.... :)
|
|
|
|
sosamv
Posts: 50
|
| Posted: 01/21/2009, 10:02 AM |
|
no i have not, what do you mean?
|
|
|
|
n0000spam
Posts: 15
|
| Posted: 02/03/2009, 6:21 AM |
|
function CCGetFromPost($parameter_name, $default_value = "")
{
return isset($_POST[$parameter_name]) ? CCStrip($_POST[$parameter_name]) : $default_value;
}
function CCStrip($value)
{
if(get_magic_quotes_gpc() != 0)
{
if(is_array($value))
foreach($value as $key=>$val)
$value[$key] = stripslashes($val);
else
$value = stripslashes($value);
}
return $value;
}
Using $db->ToSQL() function better.
|
|
|
|
|
