Re: magic_quotes
| From: | Chris Shiflett | Date: | Thu, 30 Nov 2006 20:04:25 +0000 |
| Subject: | Re: magic_quotes | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-245377@lists.php.net to get a copy of this message | ||
Johannes Lindenbaum wrote:
> Just a question out of pure curiosity. Why would one prefer
> using mysql_real_escape_string (I'm using 5.1.6 so
> mysql_escape_string is deprecated). and htmlentities instead
> of addslashes and stripslashes?
This example might be helpful:
http://shiflett.org/archive/184
It highlights the importance of character encoding consistency by
demonstrating an SQL injection attack that is immune to addslashes() but
not mysql_real_escape_string().
Hope that helps.
Chris
--
Chris Shiflett
http://shiflett.org/