php: how to prevent SQL injection from $_POST
问题 i have some php script and i think this have a lot of mistake. because of my limited knowledge in concatenation and SQL injection. At 1st time i'm not have any trouble because this script use PHP-Mysql. But after i try to change into Interbase, i meet a lot of trouble. Please help to identify my fault. this my following query: $sLimit = ""; if ( isset( $_POST['iDisplayStart'] ) ) { $sLimit = " FIRST ".$_POST['iDisplayStart']." SKIP ".$_POST['iDisplayLength']; } $sOrder =""; $sOrder = " ORDER