search

siamon123 / warehouse-inventory-system

Open source inventory management system with php and mysql
http://www.oswapp.com
MIT License
379 stars 233 forks source link

sql not parameterized #26

Closed ghost closed 6 years ago

ghost commented 6 years ago

I see you are doing escaping, but still, string concatenation, seems risky. mysqli is already there, just make all the queries parameterized to prevent injection