note 16625 deleted from function.mysql-escape-string by jimw

While mysql_escape_string is great for checking yourself, if you have your mysql user permissions set such that a malicious user COULD drop the database, you need to reexamine your whole security setup. I suggest creating a couple of different usernames with different permissions, and using them as needed. For instance, if you have a form that needs to select and insert, connect to the database as a user that can only select and insert... at no time should you allow an outside user to have access to anything that could let enter a malicious delete or drop query.