From the course: PHP: Object-Oriented Programming with Databases

Unlock the full course today

Join today to access over 24,100 courses taught by industry experts.

Sanitize values for database

Sanitize values for database - PHP Tutorial

From the course: PHP: Object-Oriented Programming with Databases

Start my 1-month free trial Buy for my team

Sanitize values for database

“

- [Instructor] Eagle-eyed observers may have noticed that we have a problem inside our project. That is, that we've not been sanitizing the data before we submit it to the database and our SQLSTATE. That's an important step. Let's say, for example, that I had an insert statement that looked something like this. I've got values for brand, model, and year that are Faker, Mike's Bike, and 2017. There's a problem with that second value, Mike's Bike. Notice that Mike's Bike is being delimited on either end by single quotes, but it also contains a single quote inside of it. SQL is going to think that the value that's being submitted is everything from the first single quote up until the single quote that's between the e and the s. Instead, we need to escape that value, so that SQL will know that it's not a meaningful character, that it's not a delimiter, that it's actually part of the text. We do that by putting a backslash in front of it. That escapes the single quote, and renders it…

Contents