note 99558 deleted from function.mysql-real-escape-string by thiago

Note Submitter: GT ---- In response to Anonymous 02-Aug-2009 10:45 Can it really be this simple? "I use the following code in my database connection include file (which is of course called at the start of every page that needs to do some SQL)... Therefore, all POST and GET vars are automatically escaped before being used anywhere in SQL statements. <?php //This stops SQL Injection in POST vars foreach ($_POST as $key => $value) { $_POST[$key] = mysql_real_escape_string($value); } //This stops SQL Injection in GET vars foreach ($_GET as $key => $value) { $_GET[$key] = mysql_real_escape_string($value); } ?>"