in reply to Re: Form Checking and Tainting
in thread Form Checking and Tainting
The behavior may vary from one DBD to the next, but for some at least, I believe using placeholders will not cause any alteration of the field data being provided. It's simply a means of conveying values to the database engine without doing any SQL interpretation of the data. So "bad characters" are neither removed nor escaped -- they should be faithfully stored as-is in the database.
|
|---|