Re: using mysql_escape_string with implode() !!
| From: | Jim Lucas | Date: | Thu, 31 May 2007 02:55:29 +0000 |
| Subject: | Re: using mysql_escape_string with implode() !! | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-255892@lists.php.net to get a copy of this message | ||
Greg Donald wrote:
On 5/30/07, Richard Lynch <ceo@l-i-e.com> wrote:Say I wanted to use this on something other than $_GET, $_POST, & $_COOKIE? Would it not be better practice to do this the other way around? function slashes ( $var ) { if ( is_scalar($var) ) {You want to use mysql_escape_string, and NOT addslashes and NOT Magic Quotes.function slashes( $var ) { if( is_array( $var ) ) { return array_map( 'slashes', $var ); } else { return mysql_real_escape_string( $var ); } }
return mysql_real_escape_string( $var );} else {
return array_map( 'slashes', $var );} } This way, even if someone passes something that is not an array, but still not processable by mysql_real_escape_string(), it won't foul up the processor.
set_magic_quotes_runtime( 0 ); if( get_magic_quotes_gpc() == 0 ) { $_GET = isset( $_GET ) ? array_map( 'slashes', $_GET ) : array(); $_POST = isset( $_POST ) ? array_map( 'slashes', $_POST ) : array(); $_COOKIE = isset( $_COOKIE ) ? array_map( 'slashes', $_COOKIE ) : array(); }