[Vaupell]

Originally Posted by Dismounted

Okay, let's start at that insecure query there. It is vulnerable to SQL injection. You should read SirAdrian's article called "Create Secure Mods". It's all good and well that you escape HTML (it's not needed, by the way, it is only needed after fetching from the database/displaying it).

Dont get it, well i understand what it does, great.

But i have no clue of placement of $db->escape_string()

cant i just go with $db->query_read_slave() ? or is it a misleading name!


Edit 2 :
okay $db->query_read_slave() dosent work, it removes all links. = dosent count
and the same with $db->escape_string() = dosent count either

PHP Code:

    $ipscount = $db->query_read_slave("
        SELECT COUNT(ipaddress) AS count 
        FROM " . TABLE_PREFIX . "post
        WHERE ipaddress='".$db->escape_string('searchstring')."' 


i mean the count is correct and all, but the page numbers that was printet with old code is gone.

giving up on this.