note 109576 deleted from function.mysql-real-escape-string by danbrown

Note Submitter: col dot shrapnel at gmail dot com ---- "If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks" - this note is just a bullshit. As a matter of fact, even if this function is used, the query remains quite vulnerable in case of any data type other than string. Yet for the strings, it have to be used despite of any attacks, but merely as a formatting measure, and nothing else. So, this function has nothing to do with SQL injection attacks at all. And SHUOLD NOT be used as a protection measure. So, as long as you are placing your data into a query as a quoted string - you have to always use this function, unconditionally. Merely as a part of a required formatting. Despite of any injections of the world. On the other hand, for any other part of the query this function is completely, utterly, ultimately USELESS. So, never follow this decieving note: do not use mysql_real_escape_string() to escape whatever "data" for the purpose of protecting queries from injections. But only for it's real purpose: to format strings.