note 69261 added to function.mysql-real-escape-string

I've seen too many functions around the lines of: <?php function safe_escape($str){ if(get_magic_quotes_gpc()){$str = stripslashes($str);} if(!is_numeric($str)){$str ="'".mysql_real_escape_string($str)."'";} return $str; }//func ?> Why is everyone so worried about magic_quotes being enabled that you can no longer use the built-in mysql_real_escape_string function any more? Just disable it at runtime regardless the server default settings. <?php set_magic_quotes_runtime(0); ?> Then you can use mysql_real_escape_string without the fear of magic_quotes being enabled. As a final note, don't send numbers through mysql_real_escape_string but rather make sure they are numberic. <?php $userid=(int)$_POST{userid}; ?> ---- Server IP: 64.71.164.2 Probable Submitter: 24.130.171.156 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/69261 Del: integrated -- https://master.php.net/note/delete/69261/integrated Del: useless -- https://master.php.net/note/delete/69261/useless Del: bad code -- https://master.php.net/note/delete/69261/bad+code Del: spam -- https://master.php.net/note/delete/69261/spam Del: non-english -- https://master.php.net/note/delete/69261/non-english Del: in docs -- https://master.php.net/note/delete/69261/in+docs Del: other reasons-- https://master.php.net/note/delete/69261 Reject -- https://master.php.net/note/reject/69261 Search -- https://master.php.net/manage/user-notes.php