note 63645 added to function.odbc-execute

Don't miss the part where it says that if your string starts and ends with a single quote, the string is interpreted as a filename! This means that you can't do: $sth = odbc_prepare($dbh, "INSERT INTO people(name) VALUES(?)"); $res = odbc_execute($sth, array($name)); without checking the value of $name--if $name is, say, '\\'c:\\passwords.txt\\'' the contents of c:\\passwords.txt get inserted into your database as a "name". Also, despite what the documentation suggests, there (incredibly) doesn't appear to be any way to escape your single quotes (via experimentation, and from reading the source): if your string starts and ends with a single quote you cannot use odbc_execute to insert it into the database. ---- Server IP: 85.116.0.130 Probable Submitter: 217.154.209.180 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.odbc-execute.php Edit -- http://master.php.net/note/edit/63645 Del: integrated -- http://master.php.net/note/delete/63645/integrated Del: useless -- http://master.php.net/note/delete/63645/useless Del: bad code -- http://master.php.net/note/delete/63645/bad+code Del: spam -- http://master.php.net/note/delete/63645/spam Del: non-english -- http://master.php.net/note/delete/63645/non-english Del: in docs -- http://master.php.net/note/delete/63645/in+docs Del: other reasons-- http://master.php.net/note/delete/63645 Reject -- http://master.php.net/note/reject/63645 Search -- http://master.php.net/manage/user-notes.php