Re: how to handle inserting special characters into a mysql field
| From: | Richard Lynch | Date: | Sat, 15 Dec 2007 17:59:12 +0000 |
| Subject: | Re: how to handle inserting special characters into a mysql field | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-265930@lists.php.net to get a copy of this message | ||
On Fri, December 14, 2007 11:03 am, Adam Williams wrote:
> $query = sprintf("SELECT * FROM users WHERE user='%s' AND
> password='%s'",
> mysql_real_escape_string($user),
> mysql_real_escape_string($password));
>
> and I understand it uses the %s because of sprintf(), to indicate the
> data is a string. However, thats not syntax I'm used to seeing. If I
> rewrite the code to the following below, will it return the same
> results
> or error when queried?
>
> $user = mysql_real_escape_string($user);
> $password = mysql_real_escape_string($password)
> $query = "SELECT * FROM users WHERE user='$user' AND
> password='$password'";
Yes, you will get the same result.
You could have run both sets of code to try it faster than I typed
this answer.
:-)
--
Some people have a "gift" link here.
Know what I want?
I want you to buy a CD from some indie artist.
http://cdbaby.com/from/lynch
Yeah, I get a buck. So?