Re: mysql_escape_string()
| From: | Chris Baechle | Date: | Fri, 09 Apr 2004 17:13:01 +0000 |
| Subject: | Re: mysql_escape_string() | ||
| References: | 1 2 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-33834@lists.php.net to get a copy of this message | ||
Jason Wong wrote:
... and is in no way related to "metacharacters as defined by the w3c". If you are having a particular problem please elaborate. As pointed out by rain forest puppyhttp://www.wiretrip.net/rfp/txt/phrack55.txt All metacharacters as defined by the w3c should be escaped for security reasons. Whether it be an sql query or shell command. Even if you don't think a particular metacharacter could be used for sql injection techniques, someone will come along and prove you wrong eventually. Mysql will properly interpret all w3c metacharacters when escaped. I suspect the mysql folks understood the need for it too.