note 94837 deleted from function.mysql-real-escape-string by danbrown
| From: | danbrown@php.net | Date: | Fri, 27 Nov 2009 18:10:51 +0000 |
| Subject: | note 94837 deleted from function.mysql-real-escape-string by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-163343@lists.php.net to get a copy of this message | ||
Note Submitter: Andy at txtNation dot com
----
With regards to the post of alan_a_williams [at] hotmail [dot] com:
It is bad pratice escaping data before actually using it. Because it can change between your
escaping it, and your using it, also, you can no longer be 100% sure that your data is escaped
*EVERY* time it is used in a query.
It is better to either use prepared statements, or, use sprintf to construct your queries, and use
just-in-time escaping.
Example:
<?php
$strQuery=sprintf(
"SHOW GRANTS FOR
%s@%s",
mysql_real_escape_string($strUser,$resConnection),
mysql_real_escape_string($strHost,$this->resConnection)
);
?>