1
I have the following code:
$db -> setQuery("
INSERT INTO sir_ter_historico (idcorretor,data,alteracao)
VALUES ($id, '$data', '$_POST['form']['numero']');
");
$db->execute();
Only it’s wrong, because of the simple quotation marks on the '$_POST['form']['numero']'.
How can I fix this?
You can put between { }, for example: ($id, '$data', '{$_POST['form']['numero']}');
– Diego Schmidt
show, thank you!
– Leandro Marzullo
This way is quite wrong to do, even putting
{}not ideal, this one$dbis what ???– novic
@Virgilionovic if you’re talking about bindParams agree
– Guilherme Nascimento
That’s it @Guilhermenascimento but, as we do not know which variable is this
$dbthe solution that the user expects always the fastest, and still receiving positive votes ... !!! incredible!– novic
@Virgilionovic yes, these Frees upvotes are a huge problem in the community, most of whom vote like this don’t really have a reasonable knowledge of language, but I’m done fighting it. If the author edits the question and details the technologies maybe I’ll reopen it and let you know.
– Guilherme Nascimento
The question was about the security of inserting that or how to insert?
– Diego Schmidt
@Diegoschmidt the problem is how to insert, but if there are other problems, they must be cited, especially when it comes to application security. The purpose of the site is to discuss solutions to problems and, by chance, find the best solution, not deliver code that works, as welfare.
– Woss
@Diegoschmidt independent of the question being about X or Y does not prevent us from indicating the ideal path, after all not because something works which is the ideal way to work. Assistentialism by assistentialism is only a major problem in the community, we should choose whenever possible to indicate the best "ways"
– Guilherme Nascimento
the $db is to make connection in the database. The "{" worked right
– Leandro Marzullo
@Guilhermenascimento I just wanted to help from a quick force, I do not care to upvote, I really hope someone of a complete answer. Hugs.
– Diego Schmidt
@Diegoschmidt I understand perfectly, but we are just trying to point something out to you to improve on this issue ;)
– Guilherme Nascimento
@Leandromarzullo mas $db é um framework?
– Guilherme Nascimento
@Guilhermenascimento Yes, I apologize for what happened then. Thank you very much, hugs!
– Diego Schmidt