note 89279 added to function.mysql-real-escape-string

Please note that mysql_real_escape_string() will not escape the char ` (left of the 1) which is often used in queries. An example: <?php $username = $_POST['username']; $password = $_POST['password']; //the user submitted the following: $username = 'foobar` --'; $myQuery = sprintf( 'SELECT * FROM my_table WHERE username = %s AND password = %s--', mysql_real_escape_string($username), mysql_real_escape_string($password) ); //$myQuery will now be: SELECT * FROM my_table WHERE username = foobar -- AND password = `-- //Which is equal to : SELECT * FROM my_table WHERE username = foobar ?> This will actually parse without a problem and you have an SQL injection. To combat this, you should also str_replace the sign for \. ---- Server IP: 83.137.20.135 Probable Submitter: 83.82.235.204 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/89279 Del: integrated -- https://master.php.net/note/delete/89279/integrated Del: useless -- https://master.php.net/note/delete/89279/useless Del: bad code -- https://master.php.net/note/delete/89279/bad+code Del: spam -- https://master.php.net/note/delete/89279/spam Del: non-english -- https://master.php.net/note/delete/89279/non-english Del: in docs -- https://master.php.net/note/delete/89279/in+docs Del: other reasons-- https://master.php.net/note/delete/89279 Reject -- https://master.php.net/note/reject/89279 Search -- https://master.php.net/manage/user-notes.php