note 56920 deleted from function.mysql-real-escape-string by aidan
| From: | aidan@php.net | Date: | Sat, 04 Feb 2006 12:06:09 +0000 |
| Subject: | note 56920 deleted from function.mysql-real-escape-string by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-102981@lists.php.net to get a copy of this message | ||
Note Submitter: pmioni at hce dot it
----
If anyone is using addslashes to escape strings before putting them in the database and thinks they
should "upgrade" to mysql_real_escape_string because it is safer (as the instructions
above seem to imply): if you read mysql's manual for the function that is being called by php,
it says
--QUOTE
Strictly speaking, MySQL requires only that backslash and the quote character used to quote the
string in the query be escaped. This function quotes the other characters to make them easier to
read in log files.
ENDQOUTE--
So if you're using addslashes, which escapes single and double quote and backslashes,
you're OK.