Re: Sanitizing potential MySQL strings with no database connection
| From: | Shawn McKenzie | Date: | Tue, 20 Oct 2009 19:20:16 +0000 |
| Subject: | Re: Sanitizing potential MySQL strings with no database connection | ||
| References: | 1 2 3 4 5 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-299130@lists.php.net to get a copy of this message | ||
Dotan Cohen wrote:
> 2009/10/20 Andrea Giammarchi <an_red@hotmail.com>:
>> even better
>>
>> $error_reporting = error_reporting(0);
>> if(mysql_real_escape_string($variable) === false)
>> {
>> error_reporting($error_reporting);
>>
>> // create a default DB connection
>>
>> } else
>> error_reporting($error_reporting);
>> unset($error_reporting);
>>
>
> Thanks, I will try that this evening. I may not have permissions for
> that, but we'll see.
>
I stole this from ZF:
function dotan_real_escape_string($value)
{
if (is_int($value)) {
return $value;
} elseif (is_float($value)) {
return sprintf('%F', $value);
}
return "'" . addcslashes($value, "\000\n\r\\'\"\032") .
"'";
}
--
Thanks!
-Shawn
http://www.spidean.com