note 84636 rejected from function.mysql-real-escape-string by danbrown
| From: | danbrown@php.net | Date: | Wed, 23 Jul 2008 15:53:11 +0000 |
| Subject: | note 84636 rejected from function.mysql-real-escape-string by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-142614@lists.php.net to get a copy of this message | ||
Note Submitter: John does not rock
----
No, your approach is bad, for a couple reasons:
1) Passwords such as "<MyPASS$<>" would be removed by strip_tags().
2) You're not considering the whole get_magic_quotes_gpc(). If that's enabled, your
routine takes user input such as "o'reilly" and returns "o\'reilly".
So if a user types o'reilly and that gets inserted into the DB as someone's last name, it
shows up in the DB as o\'reilly. Not good.