Re: Using mysql_real_escape_string without connecting to mysql

Dotan Cohen schreef:

On 23/01/2008, Richard Lynch <ceo@l-i-e.com> wrote:

On Tue, January 22, 2008 7:01 pm, Dotan Cohen wrote:

I have a file of my own functions that I include in many places. One of them uses mysql_real_escape_string, however, it may be called in a context that will or will not connect to a mysql server, and worse, may already be connected. So I must avoid connecting. However, when I run the script without connecting I get this error:

Don't do that? :-) Can the file really do anything useful without the DB?

The file defines some of my own functions, like these: function clean_html ($dirty) {

    $dirty=strip_tags($dirty);
    $clean=htmlentities($dirty);
    return $clean;

} function clean_mysql ($dirty) {

    $dirty=str_replace ("--", "", $dirty);
    $dirty=str_replace (";", "", $dirty);
    $clean=mysql_real_escape_string($dirty);
    return $clean;

}

your functions mix 2 concepts - input filtering and output escaping, they should be seperate actions.

I use these functions in many places, so I simply put them all in a file and include it in each page.

When there *IS* a connection, how do you access it?

mysql_fetch_array or mysql_result

Can't the file check somehow?

I suppose that it could, by checking the return of one of the two functions above. Lucky for me, I always use UTF-8 so I won't get stuck connecting with one encoding yet doing mysql_real_escape_string with another, which would be a problem if I had to deal with multiple encodings. Dotan Cohen http://what-is-what.com http://gibberish.co.il א-ב-ג-ד-ה-ו-ז-ח-ט-י-ך-כ-ל-ם-מ-ן-נ-ס-ע-ף-פ-ץ-צ-ק-ר-ש-ת A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?