note 86618 deleted from function.mysql-real-escape-string by aidan
| From: | aidan@php.net | Date: | Sun, 24 May 2009 19:42:03 +0000 |
| Subject: | note 86618 deleted from function.mysql-real-escape-string by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-155931@lists.php.net to get a copy of this message | ||
Note Submitter: JonathanFeller at gmx dot ch
----
a little addition to the example of Anonymous, 29-May-2008 01:10
<?php
$magic_quotes_active = get_magic_quotes_gpc();
$new_enough_php = function_exists("mysql_real_escape_string");
// i.e PHP >= v4.3.0
if ($new_enough_php) {
//undo any magic quote effects so mysql_real_escape_string can do the work
if ($magic_quotes_active) {
$string = stripslashes($string);
}
$new_string = mysql_real_escape_string($string, $mysql_connection_resource);
if (empty($new_string) && !empty($string)) {
die("mysql_real_escape_string failed."); //insert your error handling here
}
$string = $new_string;
} else { // before PHP v4.3.0
// if magic quotes aren't already on this add slashes manually
if (!$magic_quotes_active) {
$string = addslashes($string);
} //if magic quotes are active, then the slashes already exist
}
return $string;
?>
Please note that the function mysql_real_escape_string needs a valid mysql resource to succeed. I
just spent some time to find such bug in my code. So I added a bit of code to test if the function
succeeded or not.