file 1/ querydb.html------------------------------------
...
file 2/ querydb.php----------------------------
...
$query = "$_POST[query]";
$query = stripcslashes($query);
mysql_query($query, $conn)or die(mysql_error());
If I POST any $query with (') from file 1
ex. $query="update subscribers set name='theo' where..."
it will be received by file 2 like
$query = $_POST[query]="update subscribers set name=\'theo\' where..."
and then stripcslashes($query)="update subscribers set name='theo' where..."
If the query is not correct
(ex: ...("updata subscribers set name='theo' where...")
It will not be executed and there will be no
return of mysql_error().
But----------------------------------------------------------
If I pull out of the code the line
$query = stripcslashes($query);
then the query of course is not correct and will not be executes
(ex: ..."update subscribers set name=\'theo\' where...")
but
this code RETURNS the mysql_error().
Thank you for reading
2006-07-02
08:05:07
·
1 answers
·
asked by
anandsamyo
1
in
Programming & Design