note 16625 added to function.mysql-escape-string

While mysql_escape_string is great for checking yourself, if you have your mysql user permissions set such that a malicious user COULD drop the database, you need to reexamine your whole security setup. I suggest creating a couple of different usernames with different permissions, and using them as needed. For instance, if you have a form that needs to select and insert, connect to the database as a user that can only select and insert... at no time should you allow an outside user to have access to anything that could let enter a malicious delete or drop query. -- http://www.php.net/manual/en/function.mysql-escape-string.php http://master.php.net/manage/user-notes.php?action=edit+16625 http://master.php.net/manage/user-notes.php?action=delete+16625 http://master.php.net/manage/user-notes.php?action=reject+16625