note 80886 modified in function.mysql-real-escape-string by danbrown
| From: | danbrown@php.net | Date: | Sat, 14 Mar 2009 15:03:42 +0000 |
| Subject: | note 80886 modified in function.mysql-real-escape-string by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-151917@lists.php.net to get a copy of this message | ||
Don't forget to escape the escape characters in a LIKE clause!
Basically, you want to first escape the \ character, then use the mysql escape function, then escape
the % and _ special characters.
(this example assumes you are working with Unicode, hence the 'u' parameters to the
regular expressions)
For example:
<?php
$param = preg_replace( '/\\\\/u', '\\\\\\\\', $param );
$param = mysql_real_escape_string($param);
$param = preg_replace( '/([%_])/u', '\\\\$1', $param );
?>
--was--
Don't forget to escape the escape characters in a LIKE clause!
Basically, you want to first escape the \ character, then use the mysql escape function, then escape
the % and _ special characters.
For example:
<?
$param = preg_replace( '/\\\\/u', '\\\\\\\\', $param );
$param = mysql_real_escape_string($param);
$param = preg_replace( '/([%_])/u', '\\\\$1', $param );
?>
(this example assumes you are working with Unicode, hence the 'u' parameters to the
regular expressions)
http://php.net/manual/en/function.mysql-real-escape-string.php