Home/ Questions/Q 6802239
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T19:11:57+00:00

I have a SQL query that goes like this: UPDATE User SET flag=’Y’ WHERE

  • 0

I have a SQL query that goes like this:

UPDATE User SET flag='Y' WHERE email=(SELECT email FROM Forum WHERE id='$id');

Because the email address can consist of single quotes and some special characters (s*a'{f`%$.=*+~&^#|g!/hd@[66.112.45.34] and vy.”(),:;<>[]”.VY.”vy\\ \@\”vy”.unal@str.exe.com are both valid email addresses), I am not sure whether it is necessary to do the subquery separately, escape the output, followed by using it in the main query.

What is your suggestion?

ADD NOTE: $id is a safe number.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You don’t need to escape anything because there is a subquery, but of course you need to escape the id value to put it in the string.

    If possible, you should use a parameterised query instead of concatenating the value into the string. Then you don’t have to escape anything.

    • 0