Question

I’m using Zend AMF remoting in a Flex 3 project. How do I ensure that the parameters that my Flex app sends to my php doesn’t result in SQL Injection or other security problems.

How do I make the $parameterArray safe? It’s an array of string and numeric values. How do I use mysql_real_escape_string with $parameterArray? Also do I need to use htmlspecialchars? How do I use it in this case? Anything else I need to do to make it safe?

PHP:

class MyData {


public function getCrimeGradeData($parameterArray) {


$type = $parameterArray[0];
$latmax = $parameterArray[1];
$latmin = $parameterArray[2];
$lngmax = $parameterArray[3];
$lngmin = $parameterArray[4];
$startDateTime = $parameterArray[5];
$endDateTime = $parameterArray[6];


$query = "SELECT reportdatetime, type, latitude, longitude FROM table WHERE latitude < $latmax AND latitude > $latmin AND longitude < $lngmax AND longitude > $lngmin AND type = '$type' AND reportdatetime BETWEEN '$startDateTime' AND '$endDateTime'";

cont...

Answer 1

go here and have a look