note 109576 added to function.mysql-real-escape-string

"If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks" - this note is just a bullshit. As a matter of fact, even if this function is used, the query remains quite vulnerable in case of any data type other than string. Yet for the strings, it have to be used despite of any attacks, but merely as a formatting measure, and nothing else. So, this function has nothing to do with SQL injection attacks at all. And SHUOLD NOT be used as a protection measure. So, as long as you are placing your data into a query as a quoted string - you have to always use this function, unconditionally. Merely as a part of a required formatting. Despite of any injections of the world. On the other hand, for any other part of the query this function is completely, utterly, ultimately USELESS. So, never follow this decieving note: do not use mysql_real_escape_string() to escape whatever "data" for the purpose of protecting queries from injections. But only for it's real purpose: to format strings. ---- Server IP: 69.147.83.197 Probable Submitter: 178.208.156.2 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/109576 Del: integrated -- https://master.php.net/note/delete/109576/integrated Del: useless -- https://master.php.net/note/delete/109576/useless Del: bad code -- https://master.php.net/note/delete/109576/bad+code Del: spam -- https://master.php.net/note/delete/109576/spam Del: non-english -- https://master.php.net/note/delete/109576/non-english Del: in docs -- https://master.php.net/note/delete/109576/in+docs Del: other reasons-- https://master.php.net/note/delete/109576 Reject -- https://master.php.net/note/reject/109576 Search -- https://master.php.net/manage/user-notes.php