note 68285 added to function.mysql-real-escape-string

According to the newsforge refered to by Picky, it is adviseable to run PREPAREd statements in order to avoid injection. Plus, I created a table that stores pre-defined prepared statements and a procedure that runs that query. That way it's possible to control more tighly what's to be queried. Example in mysql5 lingo: create sys_queries ( name varchar(100), # query ID mysql_statement text, # primary key( name ) ); insert into sys_queries set name='search_users', 'SELECT * FROM users WHERE concat( username, name, email ) REGEXP ?'; delim $$ create sp_perform_query( _name varchar(100), _search_term varchar(255) ) begin DECLARE _stat TEXT DEFAULT NULL; SELECT mysql_statement INTO _stat FROM sys_queries WHERE name = _name; IF _stat IS NOT NULL THEN SET @a = _stat; SET @b = _search_term; PREPARE s FROM @a; EXECUTE s USING @b; END IF; end; $$ delim ; in PHP5, use mysqli to call the procedure, first arg is the query name, second, the search arg. Still don't know a good way to pass multiple arguments to mysql, so please let me know. ---- Server IP: 216.194.113.175 Probable Submitter: 200.211.216.2 (proxied: 127.0.0.1) ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- http://master.php.net/note/edit/68285 Del: integrated -- http://master.php.net/note/delete/68285/integrated Del: useless -- http://master.php.net/note/delete/68285/useless Del: bad code -- http://master.php.net/note/delete/68285/bad+code Del: spam -- http://master.php.net/note/delete/68285/spam Del: non-english -- http://master.php.net/note/delete/68285/non-english Del: in docs -- http://master.php.net/note/delete/68285/in+docs Del: other reasons-- http://master.php.net/note/delete/68285 Reject -- http://master.php.net/note/reject/68285 Search -- http://master.php.net/manage/user-notes.php