note 71201 added to function.mysql-real-escape-string

The quote_smart function in the example above has no issues with losing leading zeros. If the variable passed to it is numeric in nature then the variable is returned unchanged. This is fine as a number cannot be the source of an insertion attack. If the variable passed to it is a numbic string (that is to say a string whose format is that of a number per the rules of is_numeric) then the variable is is also returned UNCHANGED. This is also fine because even though the variable is a string, we've confirmed that it contains only numbers, with a possible '.', '+', '-', 'e' (for exponential notation), or 'x' if it's a number in hex. None of these characters is a risk. If the variable is a string and does not appear to be a number it is properly escaped. ---- Server IP: 64.71.164.2 Probable Submitter: 66.188.189.88 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/71201 Del: integrated -- https://master.php.net/note/delete/71201/integrated Del: useless -- https://master.php.net/note/delete/71201/useless Del: bad code -- https://master.php.net/note/delete/71201/bad+code Del: spam -- https://master.php.net/note/delete/71201/spam Del: non-english -- https://master.php.net/note/delete/71201/non-english Del: in docs -- https://master.php.net/note/delete/71201/in+docs Del: other reasons-- https://master.php.net/note/delete/71201 Reject -- https://master.php.net/note/reject/71201 Search -- https://master.php.net/manage/user-notes.php