note 80886 deleted from function.mysql-real-escape-string by aidan
| From: | aidan@php.net | Date: | Sun, 24 May 2009 19:43:00 +0000 |
| Subject: | note 80886 deleted from function.mysql-real-escape-string by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-155935@lists.php.net to get a copy of this message | ||
Note Submitter: Mister
----
Don't forget to escape the escape characters in a LIKE clause!
Basically, you want to first escape the \ character, then use the mysql escape function, then escape
the % and _ special characters.
(this example assumes you are working with Unicode, hence the 'u' parameters to the
regular expressions)
For example:
<?php
$param = preg_replace( '/\\\\/u', '\\\\\\\\', $param );
$param = mysql_real_escape_string($param);
$param = preg_replace( '/([%_])/u', '\\\\$1', $param );
?>