CODEWITHSUNDEEP
phpmysqlsessionescaping
MirrorMirror
MirrorMirror

Reputation: 188

mysql escape getsqlvaluestring AccID

In various mysql queries, the end part of the query string is: 

" WHERE UserID = " . $AccID

where

$AccID = $_SESSION['UID'];

and UserID is the respecting bigint column in the specific table of the db.

So my question is : do I need to escape the $AccID like this GetSQLValueString($AccID, "text") just to be on the safe side, or there is no need to, since it's not taken from a user input ?

p.s. $_SESSION['UID'] is set during the login procedure, after a successful authentication

Upvotes: 1

Views: 351

Answers (1)

kapa
kapa

Reputation: 78731

Yes, you should escape it. You should not database-escape it when you put it into $_SESSION (you might want to use it for other purposes), but before inserting into the query.

Your best bet would be though to use parameterized SQL instead of always escaping and building your queries through string concatenation. Get familiar with PDO. For a better world.

Upvotes: 3

Related Questions