note 90916 added to function.mysql-real-escape-string

SQL injection related. Please note that this function is NOT cure for every ill. It works only with strings. And only if string surrounded by quotes. It does not protect digits, when you can't cast it into string (e.g. in LIMIT parameters). Cast it to integer manually, in your script, using intval(). And, sure, it does not help with identifiers. And LPChip's comment below is totally wrong, you can't escape backtick with a slash, another backtick should be used instead. But I strongly suggest not to escape identifiers, but rather use predefined values. E.g.: <?php $orders=array("name","price","qty"); if ($key=array_search($_GET['sort'],$orders))) { $orderby=$orders[$key]; } else { $orderby=$orders[0]; } $query="SELECT * FROM table ORDER BY $orderby"; ?> ---- Server IP: 78.41.104.4 Probable Submitter: 93.81.250.218 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/90916 Del: integrated -- https://master.php.net/note/delete/90916/integrated Del: useless -- https://master.php.net/note/delete/90916/useless Del: bad code -- https://master.php.net/note/delete/90916/bad+code Del: spam -- https://master.php.net/note/delete/90916/spam Del: non-english -- https://master.php.net/note/delete/90916/non-english Del: in docs -- https://master.php.net/note/delete/90916/in+docs Del: other reasons-- https://master.php.net/note/delete/90916 Reject -- https://master.php.net/note/reject/90916 Search -- https://master.php.net/manage/user-notes.php