#40113 [NEW]: quote_smart() in the mysql_real_escape_string() documentation isn't that smart

From: romik at aha dot ru Operating system: PHP version: Irrelevant PHP Bug Type: Documentation problem Bug description: quote_smart() in the mysql_real_escape_string() documentation isn't that smart Description: ------------ There is an example function quote_smart() in the mysql_real_escape_string() documentation, Example 3. It demonstrates awfully wrong way on escaping! And allows second-order SQL injection (when data coming not from input but from database). I believe, this example should be removed from documentation. The best practice section should be like this : "If you want to handle quotes in the right way, you have to get rid of magic quotes first. By configuration or by function included into each script. And then quote all data manually, using mysql_real_escape_string()" or something like that. But there also a lot of pitfails and remarks. Actually, I've got a whole article named "complete quotes guide" but it written in russian and I'm not sure my english is good enough to translate . -- Edit bug report at http://bugs.php.net/?id=40113&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=40113&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=40113&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=40113&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=40113&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=40113&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=40113&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=40113&r=needscript Try newer version: http://bugs.php.net/fix.php?id=40113&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=40113&r=support Expected behavior: http://bugs.php.net/fix.php?id=40113&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=40113&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=40113&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=40113&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=40113&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=40113&r=dst IIS Stability: http://bugs.php.net/fix.php?id=40113&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=40113&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=40113&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=40113&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=40113&r=mysqlcfg