note 80038 added to function.mysql-real-escape-string

Unless I'm mistaken, the third example is a /very/ poor example. The code: // Make a safe query $query = sprintf("INSERT INTO products (name, description, user_id) VALUES ('%s', '%s', %d)", mysql_real_escape_string($product_name, $link), mysql_real_escape_string($product_description, $link), $_POST['user_id']); does not in any way secure $_POST['user_id'] from a malicious attack. It's very simple to secure against this, simple append (int) to $_POST['user_id'] (since it's a numerical value, anything other than a number will be converted to zero, and thus keep the system secure). That said, it would probably be wise to either check for a valid user before this query, or not using $_POST values to get the current user, since a 0 in your database for a user ID will create errors in your database, even if there aren't any security flaws. ---- Server IP: 209.41.74.194 Probable Submitter: 158.104.100.141 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/80038 Del: integrated -- https://master.php.net/note/delete/80038/integrated Del: useless -- https://master.php.net/note/delete/80038/useless Del: bad code -- https://master.php.net/note/delete/80038/bad+code Del: spam -- https://master.php.net/note/delete/80038/spam Del: non-english -- https://master.php.net/note/delete/80038/non-english Del: in docs -- https://master.php.net/note/delete/80038/in+docs Del: other reasons-- https://master.php.net/note/delete/80038 Reject -- https://master.php.net/note/reject/80038 Search -- https://master.php.net/manage/user-notes.php