note 20376 added to function.mysql-escape-string

sjohnson@fuzzygroup.com: "If you _correctly_ escape a string before putting it into a MySQL field, then when you retrieve it, you have to do a string replace to UN_ESCAPE it before displaying it." In a nutshell, that is not true. The whole purpose of mysql_escape_string and its ilk is to correctly insert data INTO the database. The outcome is much the same as escaping a character in a simple PHP string assignment: $string = 'don\'t unescape me!'; When doing <?php echo $string ?> would display: don't unescape me! when output. The mysql_escape_string function tells the database to treat that quote as actual *data*, not as a field data delimiter. -- http://www.php.net/manual/en/function.mysql-escape-string.php http://master.php.net/manage/user-notes.php?action=edit+20376 http://master.php.net/manage/user-notes.php?action=delete+20376 http://master.php.net/manage/user-notes.php?action=reject+20376