note 30896 added to function.mysql-escape-string

I found out another very curious thing about both AddSlashes() and mysql_escape_string(). It seems that for mysql, the string '##' has some special meaning. Someone told me it might be the beginning of a comment line in the SQL statement. In any case, there is only ONE #-char inserted into the database, instead of two. The two escape functions DO NOT escape this two-char-sequence. So if you want to insert an image in the database and be SURE the image is not f#ck#d up, then do the escaping yourself: $filedata = str_replace('##', '\#\#', mysql_escape_string($filedata)); $query = "insert into IMAGES (IMAGE) values ($filedata)"; $result = mysql_query($query); I hope this will save you guys the ours that I spent by searching for the bug in my own code... -- http://www.php.net/manual/en/function.mysql-escape-string.php http://master.php.net/manage/user-notes.php?action=edit+30896 http://master.php.net/manage/user-notes.php?action=delete+30896 http://master.php.net/manage/user-notes.php?action=reject+30896