On Fri, 2003-02-21 at 19:07, Martijn van Oosterhout wrote:
> You can solve the SQL injection problem by escaping all single quotes (')
> and blackslashes (\) with a backslash.
Rather than doing this by hand, I think it's probably wiser to let your
language interface do it for you. For example, libpq provides a
PQescapeString() function for escaping strings.
That particular function doesn't handle semi-colons, however.
Cheers,
Neil
--
Neil Conway <neilc@samurai.com> || PGP Key ID: DB3C29FC
