note 70565 added to function.mysql-real-escape-string

I think instead of just using the quote_smart function to quote whatever the user gives you, you should ideally specify whether you are looking for a string or a number. For example if you have a user script and are using a sql statement like this, where username is a char or varchar field: $sql="SELECT id FROM user_table WHERE user_name=".quote_smart($_POST['userName']); if the user submits 12345 for example, you get: SELECT id FROM user_table WHERE user_name=12345 Your DB 1) Must convert the 12345 to a string (not a huge deal) 2) Probably cannot use any index you have on that column (could be a bigger deal with a sizeable table) So i think something more along the lines of: function quote_smart($val,$valType) and handle the input based on $valType (being either string or numeric) ---- Server IP: 64.71.164.2 Probable Submitter: 158.118.51.2 (proxied: 1.0 PROXY3) ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/70565 Del: integrated -- https://master.php.net/note/delete/70565/integrated Del: useless -- https://master.php.net/note/delete/70565/useless Del: bad code -- https://master.php.net/note/delete/70565/bad+code Del: spam -- https://master.php.net/note/delete/70565/spam Del: non-english -- https://master.php.net/note/delete/70565/non-english Del: in docs -- https://master.php.net/note/delete/70565/in+docs Del: other reasons-- https://master.php.net/note/delete/70565 Reject -- https://master.php.net/note/reject/70565 Search -- https://master.php.net/manage/user-notes.php