note 77414 deleted from function.mysql-escape-string by nlopess
| From: | nlopess@php.net | Date: | Mon, 03 Sep 2007 14:44:46 +0000 |
| Subject: | note 77414 deleted from function.mysql-escape-string by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-130136@lists.php.net to get a copy of this message | ||
Note Submitter: mystilon at excite dot com
----
An interesting fact - this function does not work as advertised, at least on my server's verson
of php (5.0.x).
// Assume $_POST['title'] equals "Developer's Nightmare"
$form['title'] = mysql_escape_string($_POST['title']);
print $form['title'];
What you get is: Developer\\\'s nightmare
As opposed to the correct: Developers\'s nightmare
Now whenever you retrieve a record after inserting, the slashes are actually embedded in the data.
Wonderful.