note 18888 modified in function.mysql-escape-string by didou
| From: | didou@php.net | Date: | Sat, 17 May 2003 20:01:42 +0000 |
| Subject: | note 18888 modified in function.mysql-escape-string by didou | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-48232@lists.php.net to get a copy of this message | ||
if you use mysql_result(0,1)
and 0,1 has a quote in the text it won't escape the ' if you put it directly into a
sql query
example: wrong
$sql = "INSERT INTO tblsubdocuments (text) VALUES ('".
mysql_result($subdocuments,$a,1))."' )";
example: good
$sql = "INSERT INTO tblsubdocuments (text) VALUES ('".
mysql_escape_string(mysql_result($subdocuments,$a,1))."')";
if you dont do this your F#*&%%%ked
--was--
if you use msql_result(0,1)
and 0,1 has a quote in the text it won't escape the ' if you put it directly into a
sql query
example: wrong
$sql = "INSERT INTO tblsubdocuments (text) VALUES ('".
mysql_result($subdocuments,$a,1))."' )";
example: good
$sql = "INSERT INTO tblsubdocuments (text) VALUES ('".
mysql_escape_string(mysql_result($subdocuments,$a,1))."')";
if you dont do this your F#*&%%%ked
http://www.php.net/manual/en/function.mysql-escape-string.php