note 23596 added to function.mysql-query

If you shut of magic_quotes_gpc you can use this wrapper to make your mysql querys safe: function safe_query($query, $values) { $query_parts = preg_split("/\?/", $query); $safe_query = array_shift($query_parts); $needed_values = count($query_parts); $i=0; $ii=count($values); for ($i=0;$i<$ii;$i++) { $values[$i] = mysql_escape_string($values[$i]); $safe_query .= $values[$i].array_shift($query_parts); } if (count($query_parts)) { die ('Query "<i>'.$query.'</i>" needs'. $needed_values.' values, you only sent '.$ii); } return mysql_query($safe_query); } You call this function like this: $query = "select * from a where b='?' and c='?'"; $values = array("fo'o", "bar"); $result = safe_query($query, $values); Mysql will then get this query: select * from a where b='fo\'o' and c='bar' -- http://www.php.net/manual/en/function.mysql-query.php http://master.php.net/manage/user-notes.php?action=edit+23596 http://master.php.net/manage/user-notes.php?action=delete+23596 http://master.php.net/manage/user-notes.php?action=reject+23596