note 92887 deleted from function.mysql-real-escape-string by danbrown
| From: | danbrown@php.net | Date: | Thu, 13 Aug 2009 05:10:31 +0000 |
| Subject: | note 92887 deleted from function.mysql-real-escape-string by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-159431@lists.php.net to get a copy of this message | ||
Note Submitter: James P
----
@Anonymous from 8/2/2009 - Your code will only work so long as $_POST is not a multidimensional
array.
Example:
<?php
$array = array('onedeep', array(array('threedeep'),'twodeep'));
foreach($array as $key => $value) {
$array = mysql_real_escape_string($value);
}
?>
This spits out a warning: "mysql_real_escape_string() expects parameter 1 to be string, array
given". There are plenty of real-world cases where $_POST will be a multidimensional array. You
can get around this by writing a recursive escape function, such as this:
<?php
function mysql_escape_array($input){
if(is_array($input)){
foreach($input as $key=>$value){
$output[$key]=mysql_escape_array($value);
}
}else{
$output=mysql_real_escape_string($input);
}
return $output;
}
?>
There are ways to improve upon this (checking for magic quotes status, etc).