Re: MySql injections (related question)
| From: | Richard Lynch | Date: | Thu, 12 May 2005 22:52:26 +0000 |
| Subject: | Re: MySql injections (related question) | ||
| References: | 1 2 3 4 5 6 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-215085@lists.php.net to get a copy of this message | ||
On Thu, May 12, 2005 12:39 pm, James Williams said:
> I'm pretty sure that, in order to use mysql_real_escape_string() you
> must have magic quotes off or use stripslashes first... the same as
> addslashes, so it should work if you just search and replace. Don't
> quote me on that though
Well, yes, but you see it's no longer as simple as a global search and
replace, since there is no addslashes all over the place.
I have to hand-examine every file in, what, almost a decade's worth of
code spread over several dozen websites?
What is the CURRENT security advantage, if any, to
mysql_real_escape_string versus Magic Quotes?
--
Like Music?
http://l-i-e.com/artists.htm