note 101887 added to sqlite3.escapestring

SQLite3::escapeString() should be used on every piece of user input before constructing the query string, or *after* constructing the query string? Calling this function on user input BEFORE constructing the query string can lead to interesting results. For instance, it truncates e-mail addresses in an un-usable manor. ---- Server IP: 192.41.42.26 Probable Submitter: 24.130.244.119 ---- Manual Page -- http://www.php.net/manual/en/sqlite3.escapestring.php Edit -- https://master.php.net/note/edit/101887 Del: integrated -- https://master.php.net/note/delete/101887/integrated Del: useless -- https://master.php.net/note/delete/101887/useless Del: bad code -- https://master.php.net/note/delete/101887/bad+code Del: spam -- https://master.php.net/note/delete/101887/spam Del: non-english -- https://master.php.net/note/delete/101887/non-english Del: in docs -- https://master.php.net/note/delete/101887/in+docs Del: other reasons-- https://master.php.net/note/delete/101887 Reject -- https://master.php.net/note/reject/101887 Search -- https://master.php.net/manage/user-notes.php