note 70445 added to function.mysql-real-escape-string

On my machine, doing this (right from the manual) if (get_magic_quotes_gpc()) { $value = stripslashes($value); } // Quote if not a number or a numeric string if (!is_numeric($value)) { $value = "'" . mysql_real_escape_string($value) . "'"; } allows for a javascript injection <script language="Javascript"> <!-- alert ("This is a Javascript Alert") //--> </script> However if I change it to if (!get_magic_quotes_gpc()) { $value = addslashes($value); } // Quote if not a number or a numeric string if (!is_numeric($value)) { $value = "'" . mysql_real_escape_string($value) . "'"; } everything works great and the double quotes are escaped only once very nicely which seems to go against what the manual says. ---- Server IP: 66.163.161.117 Probable Submitter: 67.168.90.28 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/70445 Del: integrated -- https://master.php.net/note/delete/70445/integrated Del: useless -- https://master.php.net/note/delete/70445/useless Del: bad code -- https://master.php.net/note/delete/70445/bad+code Del: spam -- https://master.php.net/note/delete/70445/spam Del: non-english -- https://master.php.net/note/delete/70445/non-english Del: in docs -- https://master.php.net/note/delete/70445/in+docs Del: other reasons-- https://master.php.net/note/delete/70445 Reject -- https://master.php.net/note/reject/70445 Search -- https://master.php.net/manage/user-notes.php