note 89279 modified in function.mysql-real-escape-string by danbrown

Please note that mysql_real_escape_string() will not escape the char ` ([to the] left of the 1 [on US keyboards]) which is often used in queries. An example: <?php $username = $_POST['username']; $password = $_POST['password']; //the user submitted the following: $username = 'foobar` --'; $myQuery = sprintf( 'SELECT * FROM my_table WHERE username = %s AND password = %s--', mysql_real_escape_string($username), mysql_real_escape_string($password) ); //$myQuery will now be: SELECT * FROM my_table WHERE username = foobar -- AND password = `-- //Which is equal to : SELECT * FROM my_table WHERE username = foobar ?> This will actually parse without a problem and you have an SQL injection. To combat this, you should also str_replace the sign for \. --was-- Please note that mysql_real_escape_string() will not escape the char ` (left of the 1) which is often used in queries. An example: <?php $username = $_POST['username']; $password = $_POST['password']; //the user submitted the following: $username = 'foobar` --'; $myQuery = sprintf( 'SELECT * FROM my_table WHERE username = %s AND password = %s--', mysql_real_escape_string($username), mysql_real_escape_string($password) ); //$myQuery will now be: SELECT * FROM my_table WHERE username = foobar -- AND password = `-- //Which is equal to : SELECT * FROM my_table WHERE username = foobar ?> This will actually parse without a problem and you have an SQL injection. To combat this, you should also str_replace the sign for \. http://php.net/manual/en/function.mysql-real-escape-string.php