Re: Sanitizing potential MySQL strings with no database connection

Dotan Cohen wrote: > 2009/10/19 Kim Madsen <php.net@emax.dk>: >> Dotan Cohen wrote on 2009-10-18 21:21: >> >>> I thought that one could not test if a database connection is >>> established or not, this is the most relevant thing that I found while >>> googling that: >>> http://bugs.php.net/bug.php?id=29645 >> from >> http://www.php.net/manual/en/function.mysql-connect.php >> >> $link = mysql_connect('localhost', 'mysql_user', >> 'mysql_password'); >> if (!$link) { >> die('Could not connect: ' . mysql_error()); >> } >> >> So just test if $link is available >> > > I need to know if there is _any_ connection available, not a specific > connection. In one script it may be $link but in another $connection. > Dotan, You are making this thing harder then it has to be. All you need is to replicate the escaping of the same characters that mysql_real_escape_string() escapes. Simply do that. They are listed on the functions manual page on php.net http://php.net/mysql_real_escape_string Here is a function that I mocked up really quick. I have no idea if it will work, but it is a start down the right road to solve your problem(s)... <?php function clean_string($input) { /** * Character to escape... * \x0 \n \r \ ' " \x1a **/ $patterns = array( "\x0", "\n", "\r", "\\", "'", "\"", "\x1a"); $replace = array( '\\\x0', '\n', '\r', '\\\\', '\\\'', '\\"', '\\\x1a'); return str_replace($patterns, $replace, $input); } ?> Jim Lucas