Re: mysql_real_escape_string paranoid enough?

2009/3/21 Robert Cummings <robert@interjinn.com>: > Yes, I'm a big fan of automatic database connection identifiers. Why > just the other week I was integrating ZenCart into another system and I > couldn't understand why ZenCart wasn't able to properly retrieve the > last_insert_id(). After digging throught he code I found it was because > they were making use of magic identifier semantics and since another db > connection also existed, it was being used for the last_insert_id(). > Wonderful stuff. If you have a niftly little database layer, then it > shouldn't need magic semantics since it should track the connection > itself. What probably makes the most sense is instead of relying on mysqli_real_escape_string, to create a simple unicode-capable regex that does the database escaping for you. then it is totally portable. That is what is sticking in the back of my mind. Even though I force utf8 connection on any of my database handles already.