note 95423 added to function.addslashes

<?php // I wrote this function because I wanted to apply addslashes // no earlier than at the query string, but I didn't want to // have to escape each variable separately. Note that the // query string must be enclosed in single quotes, to prevent // the variables from being interpreted before they get passed // to the function. // // The function will detect variables of the following forms: // $variable // $variable[0] // $variable[string] function escaped($query, $function = "addslashes") { $e = preg_replace("|\\\$([a-zA-Z_][a-zA-Z0-9_]+)\[([^\]]*?)\]|e", "$function(\$GLOBALS[$1][$2])", $query); $e = preg_replace("|\\\$([a-zA-Z_][a-zA-Z0-9_]+)|e", "$function(\$GLOBALS[$1])", $e); return $e; } // Example: $first = 'Billy'; $nick = '"the Kid"'; $last = "O'Shea"; $query = 'INSERT INTO names VALUES ("$first", "$nick", "$last")'; echo escaped($query); // Output: // // INSERT INTO names VALUES ("Billy", "\"the Kid\"", "O\'Shea") ?> ---- Server IP: 69.147.83.197 Probable Submitter: 71.57.224.222 ---- Manual Page -- http://www.php.net/manual/en/function.addslashes.php Edit -- https://master.php.net/note/edit/95423 Del: integrated -- https://master.php.net/note/delete/95423/integrated Del: useless -- https://master.php.net/note/delete/95423/useless Del: bad code -- https://master.php.net/note/delete/95423/bad+code Del: spam -- https://master.php.net/note/delete/95423/spam Del: non-english -- https://master.php.net/note/delete/95423/non-english Del: in docs -- https://master.php.net/note/delete/95423/in+docs Del: other reasons-- https://master.php.net/note/delete/95423 Reject -- https://master.php.net/note/reject/95423 Search -- https://master.php.net/manage/user-notes.php