note 63444 added to function.mysql-real-escape-string

using printf %d / '%s' in connection with possibly numeric values can save you from trouble: <?php mysql_query(sprintf("SELECT foo FROM bar WHERE some_string='%s' AND a_number=%d",mysql_real_escape_string($string),$number)); ?> if you long for simple execution of queries, you can use a function like this as a wrapper for mysql_query (roughly emulates the way of python): <?php function mq($query, $args=NULL) { // calling without a second argument should not make printf fail if($args!==NULL && !is_array($args)) $args=array($args); if($args) foreach($args as $i => $v) $args[$i]=mysql_real_escape_string($v); $q=vsprintf($query,$args) // logging could go here $q=mysql_query($q); // error handling could go here return $q; } $query=mq("SELECT * FROM foo WHERE bar='%s'",$string); ... $query=mq("SELECT * FROM foo WHERE bar='%s' AND baz=%d",array($string,$number)); ?> such a function can also contain script-wide error handling instead of widespread mysql_query(...) or die("Error in line ".__LINE__"); ---- Server IP: 192.35.244.50 Probable Submitter: 86.59.50.121 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- http://master.php.net/note/edit/63444 Del: integrated -- http://master.php.net/note/delete/63444/integrated Del: useless -- http://master.php.net/note/delete/63444/useless Del: bad code -- http://master.php.net/note/delete/63444/bad+code Del: spam -- http://master.php.net/note/delete/63444/spam Del: non-english -- http://master.php.net/note/delete/63444/non-english Del: in docs -- http://master.php.net/note/delete/63444/in+docs Del: other reasons-- http://master.php.net/note/delete/63444 Reject -- http://master.php.net/note/reject/63444 Search -- http://master.php.net/manage/user-notes.php