note 49057 deleted from function.mysql-real-escape-string by danbrown

Note Submitter: manderson at dsrglobal dot com ---- The quote_smart() function in the "Best Practice" section does not quote any value which is all numeric. This will drop all zero's from the the lefthand side of a string. While this is intended to simplify the query string when storing numeric values this has a negative effect when trying to store strings which just so happen to be all digits. For instance some zip codes have one or more zero's on the lefthand side, and an MD5 hash may contain all numeric characters and the lefthand characters can be zero's. In these cases the lefthand zero's will be dropped. I would simply drop the is_numeric() check. There's no reason to not quote numeric values. <?php // bad query created using the quote_smart() function $qs = "UPDATE tbl SET zipcode=" . quote_smart('01234'); // UPDATE tbl SET zipcode=1234 // acceptable query created after dropping the is_numeric() check $qs = "UPDATE tbl SET number=" . quote_smart('01234'); // UPDATE tbl SET number='01234' ?>