note 99558 added to function.mysql-real-escape-string

In response to Anonymous 02-Aug-2009 10:45 Can it really be this simple? "I use the following code in my database connection include file (which is of course called at the start of every page that needs to do some SQL)... Therefore, all POST and GET vars are automatically escaped before being used anywhere in SQL statements. <?php //This stops SQL Injection in POST vars foreach ($_POST as $key => $value) { $_POST[$key] = mysql_real_escape_string($value); } //This stops SQL Injection in GET vars foreach ($_GET as $key => $value) { $_GET[$key] = mysql_real_escape_string($value); } ?>" ---- Server IP: 69.147.83.197 Probable Submitter: 83.49.27.169 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/99558 Del: integrated -- https://master.php.net/note/delete/99558/integrated Del: useless -- https://master.php.net/note/delete/99558/useless Del: bad code -- https://master.php.net/note/delete/99558/bad+code Del: spam -- https://master.php.net/note/delete/99558/spam Del: non-english -- https://master.php.net/note/delete/99558/non-english Del: in docs -- https://master.php.net/note/delete/99558/in+docs Del: other reasons-- https://master.php.net/note/delete/99558 Reject -- https://master.php.net/note/reject/99558 Search -- https://master.php.net/manage/user-notes.php