note 70565 deleted from function.mysql-real-escape-string by danbrown

Note Submitter: johniskew at web-imagineer dot com ---- I think instead of just using the quote_smart function to quote whatever the user gives you, you should ideally specify whether you are looking for a string or a number. For example if you have a user script and are using a sql statement like this, where username is a char or varchar field: $sql="SELECT id FROM user_table WHERE user_name=".quote_smart($_POST['userName']); if the user submits 12345 for example, you get: SELECT id FROM user_table WHERE user_name=12345 Your DB 1) Must convert the 12345 to a string (not a huge deal) 2) Probably cannot use any index you have on that column (could be a bigger deal with a sizeable table) So i think something more along the lines of: function quote_smart($val,$valType) and handle the input based on $valType (being either string or numeric)