note 71201 deleted from function.mysql-real-escape-string by danbrown

Note Submitter: admin of archmagesofvanadei.net ---- The quote_smart function in the example above has no issues with losing leading zeros. If the variable passed to it is numeric in nature then the variable is returned unchanged. This is fine as a number cannot be the source of an insertion attack. If the variable passed to it is a numbic string (that is to say a string whose format is that of a number per the rules of is_numeric) then the variable is is also returned UNCHANGED. This is also fine because even though the variable is a string, we've confirmed that it contains only numbers, with a possible '.', '+', '-', 'e' (for exponential notation), or 'x' if it's a number in hex. None of these characters is a risk. If the variable is a string and does not appear to be a number it is properly escaped.