Re: Sanitizing potential MySQL strings with no database connection

> No, and you clearly missed the point about that function being pretty much dead anyway. > I understand that mysql_escape_string() is depreciated. Asking about other similar functions does not seem out of line. > You mentioned also in your last email that you would make a DB connection if none existed. That > should be very easy > if you read the page on mysql_real_escape_string() > > If says: > > Returns the escaped string, or FALSE on error. > > So all you have to do, is have warnings turned off (as it generates an E_WARNING if you have no > active connection) and then look at the return value of a call to the function: > > if(mysql_real_escape_string($variable) === false) > { >     // create a default DB connection > } > Here, the key seems to be to turn the warning level down, which I do not have privileges to do on this server. But it fact this seems to be the key that I was missing, and even though I cannot make use of it at least I know in general what needs to be done. Thanks. -- Dotan Cohen http://what-is-what.com http://gibberish.co.il