Prevent SQL injection from form-generated SQL - NO PreparedStmts
- by Markos Fragkakis
Hi all,
I have a search table where user will be able to filter results with a filter of the type:
Field [Name], Value [John], Remove
Rule
Field [Surname], Value [Blake],
Remove Rule
Field [Has Children], Value [Yes],
Remove Rule
Add Rule
So the user will be able to set an arbitrary set of filters, which will result essentially in a completely…