note 98672 deleted from function.mysql-real-escape-string by danbrown

Note Submitter: nikosch ---- Most „ideas“ in the user notes for mysql_real_escape_string (mres) are simpy nonsense because of: - wrapper function have no additional value, but in most cases do ignore the important second parameter of mres. Sure -- they are shorter or do anything automatically, but in return no other developer can see, where (or if) escaping of values happens. In addition, overall escaping of GPC values is counterproductive, 'cause mres makes sense only for database operations; its no feature to handle XSS or other output related operations. - mres only makes sense in a context of a _quoted_ string area. In the wrong context (e.g. " ... WHERE id=%s") a string covered by mres is per se not „safer“ than a non quoted string. - You should not ignore the connection parameter, because the connection itself „knows“ the database-specific characters to escape. With thatr in mind this is also a point against user functions, that reproduce the behaviour of mres (Why should anyone replace mres by a functional replica at all?). Related [de]: http://aktuell.de.selfhtml.org/artikel/php/kontextwechsel/bisher.htm