Re: Sanitizing potential MySQL strings with no database connection
| From: | Nisse Engström | Date: | Tue, 20 Oct 2009 18:04:51 +0000 |
| Subject: | Re: Sanitizing potential MySQL strings with no database connection | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-299112@lists.php.net to get a copy of this message | ||
On Mon, 19 Oct 2009 15:39:40 -0700, Jim Lucas wrote:
> I have no idea if it will work, [...]
Well, you're right so far...
> <?php
>
> function clean_string($input) {
>
> /**
> * Character to escape...
> * \x0 \n \r \ ' " \x1a
> **/
>
> $patterns = array( "\x0", "\n", "\r", "\\",
> "'", "\"", "\x1a");
> $replace = array( '\\\x0', '\n', '\r', '\\\\',
> '\\\'', '\\"', '\\\x1a');
> return str_replace($patterns, $replace, $input);
> }
Not only does this not do quite what mysql_escape_string()
does, but it also fails to not do so spectacularly.
Hint:
echo str_replace (array('a','b'), array('b','c'),
'a'), "\n";
/Nisse