note 95501 added to function.mysql-real-escape-string

preventing SQL injections is important. but the mysql_real_escape_string function is useless when connecting to a MS SQL or oracle database. the following function basically replicates the functionality of mysql_real_escape_string in native php code that can be called with or with out a database connection present. /** * SQL injection protection function * the function takes a string parameter and removes * any harmful characters in the string that could be * used to hack or attack the database. * * @param string $param * @return string */ public function attackCheck($param) { return strtr($param, array( "\x00" => '\x00', "\n" => '\n', "\r" => '\r', '\\' => '\\\\', "'" => "\'", '"' => '\"', "\x1a" => '\x1a' )); } ---- Server IP: 69.147.83.197 Probable Submitter: 198.185.181.86 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/95501 Del: integrated -- https://master.php.net/note/delete/95501/integrated Del: useless -- https://master.php.net/note/delete/95501/useless Del: bad code -- https://master.php.net/note/delete/95501/bad+code Del: spam -- https://master.php.net/note/delete/95501/spam Del: non-english -- https://master.php.net/note/delete/95501/non-english Del: in docs -- https://master.php.net/note/delete/95501/in+docs Del: other reasons-- https://master.php.net/note/delete/95501 Reject -- https://master.php.net/note/reject/95501 Search -- https://master.php.net/manage/user-notes.php