note 114411 deleted from function.mssql-query by cmb
| From: | cmb@php.net | Date: | Sun, 23 Jun 2019 14:23:29 +0000 |
| Subject: | note 114411 deleted from function.mssql-query by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-211373@lists.php.net to get a copy of this message | ||
Note Submitter: andy at atcri dot com
----
Escaping the apostrophe with a blind preg_replace or str_replace may cause exponential growth of
apostrophes -- especially if magic quotes are enabled or passed values may already be escaped.
While not foolproof, this does address the problem:
if (preg_match("/\'/", preg_replace("/\'\'/", "",
$str))) {
$str = preg_replace("/\'/", "''", $str);
}