note 88713 added to function.mysql-real-escape-string

can not believe what I see here - the _POST['userid'] in the 3rd example is NOT ESCAPED and opens the door for SQL INJECTION. So it is really no wonder that there are so many vulnarable php applications out there if this manual actually teaches people how to produce vulnarable code. really, totally annoying. ---- Server IP: 212.124.37.9 Probable Submitter: 84.62.39.136 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/88713 Del: integrated -- https://master.php.net/note/delete/88713/integrated Del: useless -- https://master.php.net/note/delete/88713/useless Del: bad code -- https://master.php.net/note/delete/88713/bad+code Del: spam -- https://master.php.net/note/delete/88713/spam Del: non-english -- https://master.php.net/note/delete/88713/non-english Del: in docs -- https://master.php.net/note/delete/88713/in+docs Del: other reasons-- https://master.php.net/note/delete/88713 Reject -- https://master.php.net/note/reject/88713 Search -- https://master.php.net/manage/user-notes.php