note 119466 added to function.odbc-execute

I've been using odbc functions for quite a while and I was floored when I finally read the details about the how the parameters are handled when they start and end with single quotes! I assumed that the main reason for odbc_execute vs. odbc_exec was to prevent sql injection but apparently this added feature actually opens another security hole, perhaps worse. This was my fix: <?php function odbc_execute_clean_parameters($result_id, $parameters_array){ for($i = 0; $i < count($parameters_array); ++$i){ if( substr($parameters_array[$i], -1) == "'" && substr($parameters_array[$i], 0 ,1) == "'" ){ $parameters_array[$i].= " "; } } return odbc_execute($result_id, $parameters_array); } // then call $stmt = odbc_prepare($conn, " insert into mytable (col1, col2) values (?, ?) "); $r = odbc_execute_clean_parameters($stmt, array( $val1, $val2 ) ); ?> ---- Server IP: 72.52.91.14 Probable Submitter: 70.181.168.131 ---- Manual Page -- http://php.net/manual/en/function.odbc-execute.php Edit -- https://master.php.net/note/edit/119466 Del: integrated -- https://master.php.net/note/delete/119466/integrated Del: useless -- https://master.php.net/note/delete/119466/useless Del: bad code -- https://master.php.net/note/delete/119466/bad+code Del: spam -- https://master.php.net/note/delete/119466/spam Del: non-english -- https://master.php.net/note/delete/119466/non-english Del: in docs -- https://master.php.net/note/delete/119466/in+docs Del: other reasons-- https://master.php.net/note/delete/119466 Reject -- https://master.php.net/note/reject/119466 Search -- https://master.php.net/manage/user-notes.php