note 81614 deleted from function.mysql-real-escape-string by aidan
| From: | aidan@php.net | Date: | Sun, 24 May 2009 19:42:36 +0000 |
| Subject: | note 81614 deleted from function.mysql-real-escape-string by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-155934@lists.php.net to get a copy of this message | ||
Note Submitter: singh dot prabhat at yahoo dot com
----
One solution that I found for the quote problem is to replace quote by equivalent html number.
That is, quote symbol ' can be replaced by '
Similarly backslash can be replaced by \
This would solve the problem of SQL injection and also would not cause any issues on HTML forms
as the HTML numbers would be displayed as equivalent symbol to the user.
Also, you need not escape intended quotes and backslash before inserting into MySQL database.