Re: Sanitizing potential MySQL strings with no database connection
| From: | Dotan Cohen | Date: | Tue, 20 Oct 2009 19:19:54 +0000 |
| Subject: | Re: Sanitizing potential MySQL strings with no database connection | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-299129@lists.php.net to get a copy of this message | ||
> If you're sure that all your data is UTF-8, and that
> all user-supplied data is *actually valid* UTF-8 (and
> not deliberately or accidentally malformed), then
> mysql_escape_string() should be just fine [1].
>
I cannot ensure that the users will not be malicious, even if it is
all internal users.
--
Dotan Cohen
http://what-is-what.com
http://gibberish.co.il