I've one POST parameter in one of the page hosted at localhost server.
$name = addslashes(trim($_POST['name']));
and using PDO prepared statements in one of the Update.php page and,
When i try to submit the field with the following data, it shows a ALERT Popup which leads to XSS attack, so how can i prevent this attack so that SQL Injection and XSS won't works.
abc">
Here's the SQL Query which i'm using -
$query = "UPDATE table set name =? where id=?";
$stmt = $conn->prepare($query);
$stmt->execute(array($name,$id));
Thank you
No comments:
Post a Comment