note 108197 added to function.mysql-real-escape-string

Here are some things to keep in mind when using mysql_real_escape_string(): * If you forget to quote a parameter, mysql_real_escape_string() does not protect you from sql injection. It's not necessary to quote numeric parameters, but it's good practice to always quote all parameters. * If you accidentally call mysql_real_escape_string() twice on the same variable, you will end up with back slashes in your db. * Even you never make the above mistakes, mysql_real_escape_string() hits your server each time you escape a parameter, which can slow things down. Alternatives * As mentioned in a previous note, you can cast integer parameters using something like (int). To take it a step further, you can use PHP Filters to sanitize certain other types of data, or a regex for things like date fields. * It is much less error prone, and potentially more efficient to use prepared statements. See either mysqli or PDO. ---- Server IP: 64.71.164.2 Probable Submitter: 74.202.118.163 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/108197 Del: integrated -- https://master.php.net/note/delete/108197/integrated Del: useless -- https://master.php.net/note/delete/108197/useless Del: bad code -- https://master.php.net/note/delete/108197/bad+code Del: spam -- https://master.php.net/note/delete/108197/spam Del: non-english -- https://master.php.net/note/delete/108197/non-english Del: in docs -- https://master.php.net/note/delete/108197/in+docs Del: other reasons-- https://master.php.net/note/delete/108197 Reject -- https://master.php.net/note/reject/108197 Search -- https://master.php.net/manage/user-notes.php