Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder1.news.weretis.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.freenet.ag!news2.euro.net!xlned.com!feeder1.xlned.com!npeer.de.kpn-eurorings.net!npeer-ng0.de.kpn-eurorings.net!newsfeed.arcor.de!newsspool2.arcor-online.net!news.arcor.de.POSTED!not-for-mail Content-Type: text/plain; charset="UTF-8" Message-ID: <2525795.FS5DWkFXQh@PointedEars.de> From: Thomas 'PointedEars' Lahn Reply-To: Thomas 'PointedEars' Lahn Organization: PointedEars Software (PES) Date: Tue, 06 Nov 2012 18:59:21 +0100 User-Agent: KNode/4.4.11 Content-Transfer-Encoding: 8Bit X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&. Followup-To: comp.lang.php MIME-Version: 1.0 Lines: 32 NNTP-Posting-Date: 06 Nov 2012 18:59:22 CET NNTP-Posting-Host: 320b1871.newsspool4.arcor-online.net X-Trace: DXC=gaQ8Gi;\9YRE47KDAk81NW4IUKKPIFUG^LZW^_\Ljm4]1Y=d6Q X-Complaints-To: usenet-abuse@arcor.de Xref: csiph.com comp.lang.php:7473 Shake wrote: > El 06/11/2012 13:40, Dynamo escribió: >> $query1 = ("UPDATE mytable SET drawing = 'mydrawing.pdf' WHERE id=2"); > [...] >> $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2"); > > -------------------------------------------^ > > There are no quotes. Either one allows for SQL injection. The OP should read on Prepared Statements (but at least mysql_real_escape_string()) instead. > Incorrect: > - $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2"); > correct: > - $query1 = ("UPDATE mytable SET drawing = '$drawing' WHERE id=2"); The parentheses are unnecessary and misleading. The names should be backtick-quoted. > That's not a PHP problem. Is a SQL one. _MySQL_, and you do not appear to know either very well. PointedEars -- Danny Goodman's books are out of date and teach practices that are positively harmful for cross-browser scripting. -- Richard Cornford, cljs, (2004)