Re: Multiple databases

[Andrew Blake]

Hi Rick

An extract from my code.

CREATE DATABASE $sql_database;
GRANT ALL PRIVILEGES ON $sql_database.* TO '$sql_user'@'$sql_host' IDENTIFIED BY '$sql_passwd';
GRANT ALL PRIVILEGES ON $sql_database.* TO '$sql_user'@'%' IDENTIFIED BY '$sql_passwd';

The variables here are regular expression forced/tested to be alpha-numeric prior to execution - so I think my grants are ok.

Interested in knowing more about how and why prepared statements still don't necessarily block injection attacks and what I should be doing instead or in addition? I had thought that blocking injection attacks was a large advantage of prepared statements (well that and speed if executing the same construct repeatedly).