Re: SQL Escape Characters in PHP

Hello Keith, On 01-Aug-00 16:24:16, you wrote: >Hi, quick question. When you send an sql statement to a database (through >ODBC, etc.) if a string that you send has single quotes in it they have to >be escaped. JDBC has a thing where you can automatically have it escape the >string for you, for instance: >java.sql.PreparedStatement pstmt = connection.prepareStatement("insert into >clients (client_name, client_address) values(?, ?)"); >pstmt.setString(1, "St. Joseph's Hospital"); >pstmt.setString(2, "1 Good Samaritan Rd."); >pstmt.executeUpdate(); >You don't even have to put single quotes around the question marks in the >prepared statement string because it knows what to do. >Is there anything equivalent in PHP, or do I have to do ereg_replaces on >every string I send to the database to make sure I don't break it with >unescaped quote characters? Yes, Metabase PHP database abstraction package. It does exactly that not only for text fields, but also for fields of other types like date/time, float/fixed point numbers, boolean, etc.. That is a better approach than other database abstraction packages like Perl DBI and other clone packages that treat everything as text. Like JDBC, Metabase provides real data type abstraction and you don't have to put up with eventual differences in data type representation. For instance dates in Metabase are always represented in the ISO 8601 format (YYYY-DD-MM) regardless how the underlying database represents them even when they are not supported at all. This is very important when you want to develop applications that you cannot antecipate with how many different DBMS will be run. Metabase is free and you may find it here. http://phpclasses.UpperDesign.com/browse.html/package/20 Regards, Manuel Lemos Web Programming Components using PHP Classes. Look at: http://phpclasses.UpperDesign.com/?user=mlemos@acm.org -- E-mail: mlemos@acm.org URL: http://www.mlemos.e-na.net/ PGP key: http://www.mlemos.e-na.net/ManuelLemos.pgp --