Re: Using mysql_real_escape_string without connecting to mysql
| From: | Dotan Cohen | Date: | Wed, 23 Jan 2008 17:25:43 +0000 |
| Subject: | Re: Using mysql_real_escape_string without connecting to mysql | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-267910@lists.php.net to get a copy of this message | ||
On 23/01/2008, Jochem Maas <jochem@iamjochem.com> wrote:
> > The file defines some of my own functions, like these:
> >
> > function clean_html ($dirty) {
> > $dirty=strip_tags($dirty);
> > $clean=htmlentities($dirty);
> > return $clean;
> > }
> >
> > function clean_mysql ($dirty) {
> > $dirty=str_replace ("--", "", $dirty);
> > $dirty=str_replace (";", "", $dirty);
> > $clean=mysql_real_escape_string($dirty);
> > return $clean;
> > }
>
> your functions mix 2 concepts - input filtering and output escaping,
> they should be seperate actions.
They are separate actions. One is on (for example) accept.php and the
other on display.php. However, there are tens of pages which accept
info, and tens of others which display info. And these are just two
functions: I have quite a few more. It would be impossible to break
them up into separate include pages because I'd be including 90% of
them on each page anyway.
Dotan Cohen
http://what-is-what.com
http://gibberish.co.il
א-ב-ג-ד-ה-ו-ז-ח-ט-י-ך-כ-ל-ם-מ-ן-נ-ס-ע-ף-פ-ץ-צ-ק-ר-ש-ת
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?