note 63286 added to function.mysql-real-escape-string

You don't need to use mysql_real_escape_string() on variables submitted via $_POST. They are already escaped, e.g. ' has become \' already. So if you call mysql_real_escape_string() again, then you just get those \ literally in your MySQL data. ---- Server IP: 216.194.113.175 Probable Submitter: 66.92.144.74 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- http://master.php.net/note/edit/63286 Del: integrated -- http://master.php.net/note/delete/63286/integrated Del: useless -- http://master.php.net/note/delete/63286/useless Del: bad code -- http://master.php.net/note/delete/63286/bad+code Del: spam -- http://master.php.net/note/delete/63286/spam Del: non-english -- http://master.php.net/note/delete/63286/non-english Del: in docs -- http://master.php.net/note/delete/63286/in+docs Del: other reasons-- http://master.php.net/note/delete/63286 Reject -- http://master.php.net/note/reject/63286 Search -- http://master.php.net/manage/user-notes.php