note 69261 deleted from function.mysql-real-escape-string by betz
| From: | betz@php.net | Date: | Sat, 02 Sep 2006 11:45:30 +0000 |
| Subject: | note 69261 deleted from function.mysql-real-escape-string by betz | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-116615@lists.php.net to get a copy of this message | ||
Note Submitter: Ultimater at gmail dot com
----
I've seen too many functions around the lines of:
<?php
function safe_escape($str){
if(get_magic_quotes_gpc()){$str = stripslashes($str);}
if(!is_numeric($str)){$str ="'".mysql_real_escape_string($str)."'";}
return $str;
}//func
?>
Why is everyone so worried about magic_quotes being enabled that you can no longer use the built-in
mysql_real_escape_string function any more? Just disable it at runtime regardless the server
default settings.
<?php
set_magic_quotes_runtime(0);
?>
Then you can use mysql_real_escape_string without the fear of magic_quotes being enabled.
As a final note, don't send numbers through mysql_real_escape_string but rather make sure they
are numberic.
<?php
$userid=(int)$_POST{userid};
?>