Php And Ms-sql: How To Prevent Sql Injection?

Author: admin  //  Category: SQl Injection

I use PHP and Microsoft SQL Server 2000 to build dymanic pages. Assume I have code like this:
$id = $_POST['id'];
$query = “select * from employees where id = ‘$id’”;
$result = mssql_query($query);
Is this safe from SQL injection?
If not, how to prevent it?

Tags: , ,

3 Responses to “Php And Ms-sql: How To Prevent Sql Injection?”

  1. Help Me Says:

    Please to gohttp://www.askbee.net/articles/php/SQL_I…http://www.codeproject.com/cs/database/S…http://msdn2.microsoft.com/en-us/library…http://www.sqlservercentral.com/columnis…http://forum.joomla.org/index.php?topic=…

  2. giraffe Says:

    The answer is yes. Check the answer immediately above mine for possible solutions.

  3. Colinc Says:

    You can’t suffer injection from a select query, as long as your previous code set up the id correctly this is safe.

Leave a Reply