Re: Programmers toolkit - C api sprintf-like mysql_query()

[Quoted] Jerry Stuckle wrote:

[snip]

> Ensure you call mysql_real_escape_string() for all non-numeric values
> that come from external sources. Failure to do so can lead to a SQL
> injection attack.

[Quoted] Thanks for the reminder, Jerry.

[Quoted] I don't see, however, how that suggestion has anything directly to do with the code I posted, or the implementation pattern it replaces.

To me, it is about as helpfull as also reminding everyone who read my post that they must call mysql_init() to obtain a valid dbm handle; it's true, and important, but irrelevant to the current discussion.

But, thanks anyway for the reminder.

-- 
Lew Pitcher
"In Skills, We Trust"
PGP public key available upon request