RE: [PHP] Single Quotes in Form Inputs
| From: | Bob McConnell | Date: | Mon, 27 Jul 2009 19:44:52 +0000 |
| Subject: | RE: [PHP] Single Quotes in Form Inputs | ||
| References: | 1 2 3 4 5 6 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-295904@lists.php.net to get a copy of this message | ||
From: Yuri Yarlei
> I think mysql_real_escape_string() is work well, but if
> you are use mysql db, if you are using another db, the best
> function is addslashes but for another special charactes
> you will need treat them with another ways
Slashes are the wrong character to use. The official SQL escape is a
single quote character. Some database managers accept either, but using
slashes can cause more problems than they solve. Find the correct
escape_string function for your database and use it.
Bob McConnell