RE: [PHP] MySql injections (related question)

> -----Original Message----- > From: Richard Lynch [mailto:ceo@l-i-e.com] > Sent: Thursday, May 12, 2005 8:47 AM > I'd bet a dollar that if the MySQL C Client library changed what needs > escaping, addslashes would change with it. Ehhh? I think not. Let´s let a mindgame (can´t spell hypo..whatever :-) and say that the MySQL folk figures out they wanna use the same way for escaping as PostgreSQL, then addslashes() would add ' ? The whole idea of nameconvention is gone then :-) But I do agree with You, need to hear *WHY* the mysql_real_escape_string() is better (and a so fu****' long word :) > What problem do you think addslashes() was written to solve? For those who has magic qoutes off? I still can figure out why some people hate that setting so much? Though one´s not safe with only magic quotes, addslashes() are needed too... -- Med venlig hilsen / best regards ComX Networks A/S Kim Madsen Systemudvikler/Systemdeveloper