Re: Sanitizing potential MySQL strings with no database connection
| From: | Kim Madsen | Date: | Sun, 18 Oct 2009 10:24:04 +0000 |
| Subject: | Re: Sanitizing potential MySQL strings with no database connection | ||
| References: | 1 2 3 4 5 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-299027@lists.php.net to get a copy of this message | ||
Dotan Cohen wrote on 2009-10-18 10:52:
test if you have a db connection in the function, if not, skip MRES and other mysql_ functions? In my opinion it's bad code to use a mysql_* function on a Oracle db (and vice versa) or on a string for that matter. It lies in the naming of the function what it's designed to do and work on. If you want a general function to sanitize an input, make your own function sanitize_input() based on ereg_* and/or str_replace and the likes. -- Kind regards Kim EmaxI assumed the reason you wanted to do escape the string so that you could perform DB operations.Yes, that is my intention. However, the function is found in an include file of functions used in many different scripts, each of which connect to a different database or may not connect to a database at all, so I cannot rely on there existing a database connection.