in reply to Updating my database...or not
If the code hasn't changed, and the data input has, then I'd suspect that you've got a quote in your input data that's munging your SQL statement into something like:
insert into searchresult values ('foo', 'alphabet'soup', 'gourmand');delete users;')
Instead of building a string like:
insert into searchresult values ('a','b','c')
you should use placeholders and make your sql like:
insert into searchresult values (?, ?, ?)
Then instead of executing your SQL with:
$sth->execute()
you could use:
$sth->execute(@ParmList);
Of course, you'll have to change the code a little and build the @ParmList array. But it'll shield you from problems like you're getting....roboticus
|
|---|