<slide title="Securing SQLite Queries">
<blurb>SQLite has it's own query escaping function, sqlite_escape_string() that in addition to simple
data escaping will also encode binary data.</blurb>

<example fontsize="1.6em" title=""><![CDATA[<?php
	$db = sqlite_open("/path/to/database") or die($error);

	$query = 'BEGIN;';
	for ($i = 0; $i < 10; $i++) {
		$query .= "INSERT INTO tbl VALUES(".sqlite_escape_string($_POST['field_'.$i]).");";
	}
	$query .= "COMMIT;"
	sqlite_query($query, $db);
?>]]>
</example>

<list>
	<bullet>|FF0000|Binary encoding performed by sqlite_escape_string() will make LIKE comparisons unusable.|</bullet>
</list>

</slide>
