note 94837 added to function.mysql-real-escape-string

With regards to the post of alan_a_williams [at] hotmail [dot] com: It is bad pratice escaping data before actually using it. Because it can change between your escaping it, and your using it, also, you can no longer be 100% sure that your data is escaped *EVERY* time it is used in a query. It is better to either use prepared statements, or, use sprintf to construct your queries, and use just-in-time escaping. Example: <?php $strQuery=sprintf( "SHOW GRANTS FOR %s@%s", mysql_real_escape_string($strUser,$resConnection), mysql_real_escape_string($strHost,$this->resConnection) ); ?> ---- Server IP: 92.48.74.199 Probable Submitter: 82.32.242.167 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/94837 Del: integrated -- https://master.php.net/note/delete/94837/integrated Del: useless -- https://master.php.net/note/delete/94837/useless Del: bad code -- https://master.php.net/note/delete/94837/bad+code Del: spam -- https://master.php.net/note/delete/94837/spam Del: non-english -- https://master.php.net/note/delete/94837/non-english Del: in docs -- https://master.php.net/note/delete/94837/in+docs Del: other reasons-- https://master.php.net/note/delete/94837 Reject -- https://master.php.net/note/reject/94837 Search -- https://master.php.net/manage/user-notes.php