Re: Sanitizing potential MySQL strings with no database connection
| From: | Nisse Engström | Date: | Tue, 20 Oct 2009 19:43:24 +0000 |
| Subject: | Re: Sanitizing potential MySQL strings with no database connection | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-299137@lists.php.net to get a copy of this message | ||
On Tue, 20 Oct 2009 20:04:51 +0200, Nisse Engström wrote:
> On Mon, 19 Oct 2009 15:39:40 -0700, Jim Lucas wrote:
>
>> /**
>> * Character to escape...
>> * \x0 \n \r \ ' " \x1a
>> **/
>>
>> $patterns = array( "\x0", "\n", "\r", "\\",
>> "'", "\"", "\x1a");
>> $replace = array( '\\\x0', '\n', '\r', '\\\\',
>> '\\\'', '\\"', '\\\x1a');
>> return str_replace($patterns, $replace, $input);
>> }
>
> Not only does this not do quite what mysql_escape_string()
Brain fart. I was looking at the wrong list of characters
that should be escaped.
> does, but it also fails to not do so spectacularly.
Still...
/Nisse