note 107693 deleted from function.mysql-real-escape-string by danbrown

Note Submitter: spam at douglasheld dot net ---- This is all completely approaching the security problem the wrong way. Escaping the input parameter to fit into SQL is a blacklisting approach that invites attackers to try new combinations, character encodings, missed assumptions etc, in order to accomplish a new SQL injection. A whitelisting approach is better; prepared statements are generally understood to be a whitelisting approach. You should all be using mysqli_prepare instead of all this. I do this for my day job.