[PHP-DOC] cvs: phpdoc /en/reference/mysql/functions mysql-real-escape-string.xml

[Jakub Vrana]

vrana           Wed Sep 29 07:52:42 2004 EDT

  Modified files:              
    /phpdoc/en/reference/mysql/functions        mysql-real-escape-string.xml 
  Log:
  SQL injection (bug #30274)
  
http://cvs.php.net/diff.php/phpdoc/en/reference/mysql/functions/mysql-real-escape-string.xml?r1=1.16&r2=1.17&ty=u
Index: phpdoc/en/reference/mysql/functions/mysql-real-escape-string.xml
diff -u phpdoc/en/reference/mysql/functions/mysql-real-escape-string.xml:1.16 
phpdoc/en/reference/mysql/functions/mysql-real-escape-string.xml:1.17
--- phpdoc/en/reference/mysql/functions/mysql-real-escape-string.xml:1.16       Mon 
Sep 20 04:52:55 2004
+++ phpdoc/en/reference/mysql/functions/mysql-real-escape-string.xml    Wed Sep 29 
07:52:42 2004
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="iso-8859-1"?>
-<!-- $Revision: 1.16 $ -->
+<!-- $Revision: 1.17 $ -->
 <!-- splitted from ./en/functions/mysql.xml, last change in rev 1.100 -->
   <refentry id="function.mysql-real-escape-string">
    <refnamediv>
@@ -88,7 +88,7 @@
 
 // We didn't check $_POST['password'], it could be anything the user wanted! For 
example:
 $_POST['username'] = 'aidan';
-$_POST['password'] = "' OR 1=1";
+$_POST['password'] = "' OR ''='";
 
 // This means the query sent to MySQL would be:
 echo $query;