note 70445 rejected from function.mysql-real-escape-string by betz

Note Submitter: chris at rubberducktech dot com ---- On my machine, doing this (right from the manual) if (get_magic_quotes_gpc()) { $value = stripslashes($value); } // Quote if not a number or a numeric string if (!is_numeric($value)) { $value = "'" . mysql_real_escape_string($value) . "'"; } allows for a javascript injection <script language="Javascript"> <!-- alert ("This is a Javascript Alert") //--> </script> However if I change it to if (!get_magic_quotes_gpc()) { $value = addslashes($value); } // Quote if not a number or a numeric string if (!is_numeric($value)) { $value = "'" . mysql_real_escape_string($value) . "'"; } everything works great and the double quotes are escaped only once very nicely which seems to go against what the manual says.