styfle/The-Harvest-Club — Issue #23: Prevent SQL Injection
Author: styfle
Created: 2012-03-08 03:02:44+00:00
State: open
Labels: High Priority

We need to escape every string from the user that is appended to a SQL query. Anywhere you see `$sql` there should be **no** concatenation with `$_REQUEST` strings as they may contain apostrophes or other SQL queries.