Re: escape your variables

Kyle Terry wrote:

On Wed, Mar 4, 2009 at 6:55 PM, Chris <dmagick@gmail.com> wrote:

Eric Butera wrote:

On Wed, Mar 4, 2009 at 8:18 PM, Chris <dmagick@gmail.com> wrote:

You only need to escape data coming from a user going in to your database.

If you put user input into your database and pull it back out, it's still raw user input. Never trust any piece of data ever, whether it comes from a superglobal OR within your app itself.

Isn't that what I said? -- Postgresql & php tutorials http://www.designmagick.com/ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Actually no; you said "You only need to escape data coming from a user going in to your database."

mysql_real_escape_string is only needed to prevent sql issues going in. Of course your filter needs to check for other things before you put it in, but not because of the integrity of the sql statement. Once it is in the database, the mysql_real_escape_string has served it's purpose - it's in the database. mysql> select name from foo; +---------------+

| name          |

+---------------+ | Bill O'Really | +---------------+ The \ is no longer there. You don't need stripslashes or anything else to use it in output. If you are going to use it for additional queries then you need to escape it again for the integrity of the query, but in most cases it is better to query based upon a unique ID integer associated with the name (primary key) - unless you are looking for multiple records with same name field, in which case you probably are dealing with a user input request that you have escaped when you ate the _POST variable.