Re: Using mysql_real_escape_string
| From: | Eric Butera | Date: | Mon, 09 Oct 2006 19:02:48 +0000 |
| Subject: | Re: Using mysql_real_escape_string | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-242868@lists.php.net to get a copy of this message | ||
On 10/9/06, Alan Milnes <css@milnes7.com> wrote:
Wrap escaping functions around the values you are sticking in the DB. Escaping is only needed at the time you are using it because it helps your data go somewhere. You don't want to corrupt your data with escaped values. $query = "insert into invw2wcheck ($query = "insert into invw2wcheck ( UNIQUEID ,ASSETID , CNF ) values ( '$UNIQUEID', '$ASSETID ', '$CNF' )";
UNIQUEID ,ASSETID , CNF ) values ( '". mysql_real_escape_string($UNIQUEID) ."', '". mysql_real_escape_string($ASSETID) ."', '". mysql_real_escape_string($CNF) ."' )";