Re: mysql_real_escape_string paranoid enough?

On Fri, Mar 20, 2009 at 9:41 AM, Richard Lynch <ceo@l-i-e.com> wrote: > I typically do something like this: > > $data_sql = mysql_real_escape_string($data, $connection); > $query = "insert into data(data) values('$data_sql')"; > $insert = mysql_query($query, $connection); > if (!$insert){ >  trigger_error(mysql_error($connection), E_USER_ERROR); > } Slightly off topic here, but I find it annoying to have to use the connection identifier for the mysqli_real_escape_string. It would be great if there was a function that I could say mysql_escape_string that is using utf-8 instead of default, as opposed to having to use mysqli_real_escape_string. I suppose a custom function could be written using regexps or even simple string replacement and mbstring stuff...