note 90916 deleted from function.mysql-real-escape-string by danbrown

Note Submitter: phpfanat at yandex dot ru ---- SQL injection related. Please note that this function is NOT cure for every ill. It works only with strings. And only if string surrounded by quotes. It does not protect digits, when you can't cast it into string (e.g. in LIMIT parameters). Cast it to integer manually, in your script, using intval(). And, sure, it does not help with identifiers. And LPChip's comment below is totally wrong, you can't escape backtick with a slash, another backtick should be used instead. But I strongly suggest not to escape identifiers, but rather use predefined values. E.g.: <?php $orders=array("name","price","qty"); if ($key=array_search($_GET['sort'],$orders))) { $orderby=$orders[$key]; } else { $orderby=$orders[0]; } $query="SELECT * FROM table ORDER BY $orderby"; ?>