note 107827 added to function.mysql-real-escape-string

I have made a mix to similate something similar to "prepared statements" with real_scape option: First, I made a wrap of mysql_query function like this: function sqlSelect($sql) { $params=func_get_args(); $sql=PreparaSQL($sql, $params); $res = mysql_query($sql); if (!$res) die($sql." " . mysql_error()); return($res); } This function accepts more parameters that the $sql param defined. You can use it as: $result = sqlSelect('select ....', p1, p2, p3, etc) where p1, p2, etc.. are the extra parameters. You also need to define the following function that scapes the extra parameters: function PreparaSQL($sql, $array_param){ unset($array_param[0]); // el primer parámetro es la sql, y la quito foreach ($array_param as $k => $v){ $array_param[$k]=mysql_real_escape_string($v); } return vsprintf( str_replace("?","'%s'",$sql), $array_param ); } So, now, you can change from: mysql_query("SELECT * FROM users WHERE user ='".mysql_real_escape_string($user)."' and password='".mysql_real_escape_string($password)."'); to..... sqlSelect("SELECT * FROM users WHERE user =? and password=?', $user, $password); I hope it will be useful. ---- Server IP: 69.147.83.197 Probable Submitter: 83.42.107.65 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/107827 Del: integrated -- https://master.php.net/note/delete/107827/integrated Del: useless -- https://master.php.net/note/delete/107827/useless Del: bad code -- https://master.php.net/note/delete/107827/bad+code Del: spam -- https://master.php.net/note/delete/107827/spam Del: non-english -- https://master.php.net/note/delete/107827/non-english Del: in docs -- https://master.php.net/note/delete/107827/in+docs Del: other reasons-- https://master.php.net/note/delete/107827 Reject -- https://master.php.net/note/reject/107827 Search -- https://master.php.net/manage/user-notes.php