Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
For example:
$data = file_get_contents($_FILES['image']['tmp_name']);
$data = mysql_real_escape_string($data);
mysql_query("INSERT INTO table set image='$data'....
Is this a correct way to stick with?
I would recommend keeping it unless there is a reason to remove it, as its a good way to prevent sql injection. See here: http://php.net/manual/en/function.mysql-real-escape-string.php .
It is probably possible to do sql injection through an image that a user could upload or a client could accidentally use.
A reason not to use it could be performance. I would tend to recommend security over performance.