<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Dec 21, 2015, at 12:41, Vince Herried <<a href="mailto:Vince@planetvince.com" class="">Vince@PlanetVince.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><p dir="ltr" class="">I changed it to letter= <br class="">
Problem solved... Well now I have to watch out for SQL injection, but since i only allow a single char, easy</p></div></blockquote><br class="">Watch out: if that one character is ‘;’ you could be in trouble. Always, always validate/sanitize your user-derived inputs, and use prepared statements (or your DB’s equivalent of input handling) when talking to the DB - reads and writes.</div><div><br class=""></div><div>Avoiding SQL injection is fairly easy. If you do absolutely nothing else with the data, find out what your DB engine uses for parameterized queries and always parameterize any user-land inputs.<br class=""><div><br class=""></div></div>Never take user input at literal value. Especially for web-based applications.</body></html>