note 107480 added to function.mysql-real-escape-string

To answer the previous comment. You are not supposed to send the sql sentence to the function, but only for user provided parameters of the sql sentence to be sure that user can't inject sql code. Say, you ask that menu-attribute of your example from user, it would become: $attr=$_POST['attr']; $sql="Select * from table where attribute = '" . mysql_real_escape_string($attr) . "'"'; ---- Server IP: 69.147.83.197 Probable Submitter: 62.165.130.126 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/107480 Del: integrated -- https://master.php.net/note/delete/107480/integrated Del: useless -- https://master.php.net/note/delete/107480/useless Del: bad code -- https://master.php.net/note/delete/107480/bad+code Del: spam -- https://master.php.net/note/delete/107480/spam Del: non-english -- https://master.php.net/note/delete/107480/non-english Del: in docs -- https://master.php.net/note/delete/107480/in+docs Del: other reasons-- https://master.php.net/note/delete/107480 Reject -- https://master.php.net/note/reject/107480 Search -- https://master.php.net/manage/user-notes.php