Hacker News new | ask | show | jobs
by smackjer 5952 days ago
Escape the quote. See http://en.wikipedia.org/wiki/SQL_injection#Preventing_SQL_in...
1 comments

Escaping will get you killed. Do you know what %u2032 means? +ACc-? %ef%bd%b1? Parameterize the query.
Ignoring the part about PHP not knowing the difference between a byte and a character...%2032? There are databases where something other than ASCII single quote will terminate a string?
Sure. It depends on the database, the way the query is constructed, and the way the handle is initialized. But the bigger problem is what the web stack does to the query before it hits the database.

People have been playing charset games to get past SQL quoting for almost 10 years now, and not just in PHP.