It seems to be common knowledge to use mysql_set_charset
/ mysqli::set_charset
instead of the direct MySQL query set names
.
The reason often cited is that set names
is insecure because the encoding used for mysql_real_escape_string
/ mysqli::real_escape_string
will only be set by a call to mysql_set_charset
/ mysqli::set_charset
. (Another reason cited is that the PHP docs says it's "not recommended" §.)
However, is it safe to use the direct MySQL query set names
if we use prepared statements andor other means of escaping besides mysql_real_escape_string
/ mysqli::real_escape_string
/ mysqli_escape_string
?
Besides affecting the encoding of mysql_real_escape_string
/ mysqli::real_escape_string
/ mysqli_escape_string
, Is there any difference between set names
vs mysql_set_charset
/mysqli::set_charset
?
Aucun commentaire:
Enregistrer un commentaire