note 64194 added to function.mysql-real-escape-string

Hey, Since SQL injection is such a fear it is beyond me as to why this hasn't been included yet. I set this function up to take a query with ?'s in it and replace those with the correctly quoted values. I don't do the "smart quoteing" i quote it in the SQL because i like to see the quotes there. <?php function db_query($query) { $args = func_get_args(); $query = array_shift($args); $query = str_replace("?", "%s", $query); $args = array_map('mysql_real_escape_string', $args); array_unshift($args,$query); $query = call_user_func_array('sprintf',$args); $result = mysql_query($query) or die('Query failed: ' . mysql_error()); return $result; } ?> call it like <?php $results = db_query("SELECT * FROM users WHERE username='?' AND password = PASSWORD('?');", $username,$password); ?> This automagicaly quotes them and executes the query for you and also dies if there is an error in the query. ---- Server IP: 64.71.164.2 Probable Submitter: 24.8.74.230 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- http://master.php.net/note/edit/64194 Del: integrated -- http://master.php.net/note/delete/64194/integrated Del: useless -- http://master.php.net/note/delete/64194/useless Del: bad code -- http://master.php.net/note/delete/64194/bad+code Del: spam -- http://master.php.net/note/delete/64194/spam Del: non-english -- http://master.php.net/note/delete/64194/non-english Del: in docs -- http://master.php.net/note/delete/64194/in+docs Del: other reasons-- http://master.php.net/note/delete/64194 Reject -- http://master.php.net/note/reject/64194 Search -- http://master.php.net/manage/user-notes.php