note 18888 added to function.mysql-escape-string

if you use msql_result(0,1) and 0,1 has a quote in the text it won't escape the ' if you put it directly into a sql query example: wrong $sql = "INSERT INTO tblsubdocuments (text) VALUES ('". mysql_result($subdocuments,$a,1))."' )"; example: good $sql = "INSERT INTO tblsubdocuments (text) VALUES ('". mysql_escape_string(mysql_result($subdocuments,$a,1))."')"; if you dont do this your F#*&%%%ked -- http://www.php.net/manual/en/function.mysql-escape-string.php http://master.php.net/manage/user-notes.php?action=edit+18888 http://master.php.net/manage/user-notes.php?action=delete+18888 http://master.php.net/manage/user-notes.php?action=reject+18888