note 34294 deleted from function.mysql-escape-string by nicos

Note Submitter: RobNar ---- Newbies: Please note that 'daniel141 at yahoo dot com' seems confused. There is no need to write your own function to escape string data for MySQL's use--that is what mysql_escape_string() and mysql_real_escape_string() are for. magic_quotes_gpc() and magic_quotes_runtime() should both be set to off, but if you can't change those settings yourselves then do as daniel was trying to do: Check if it is off and handle it accordingly. // returns the untouched string if magic_quotes_gpc // has already done our dirty work. // else, escape the string. function mysqlEscape($str) { if(get_magic_quotes_gpc()) return $str; else return mysql_real_escape_string($str); } Simple as that. Also keep in mind that if magic_quotes_runtime is turned off (which it should be) then you do NOT need to unescape the data that MySQL returns. The DB handles all of that for you. For example, if you send mySQL the string: "This isn\'t my day!" It will return "This isn't my day!" when you retrieve the string. If you are worried about magic_quotes_runtime screwing with your data then pass it through something like this to make sure it is decoded: // This function strips out the slashes added by // magic_quotes_runtime (but only if magic_quotes_runtime // is set) function unescapeString($str) { if(get_magic_quotes_runtime()) return stripslashes($str); else return $str; } Daniel's last escape function would oeprate on the GET, POST, and COOKIE arrays automatically, but mine operates on a single string at a time. It's up to you to decide if it is worth escaping strings individually or all at once. I usually end up writing a DB wrapper that handles all of this automatically so I don't have to worry about it. I hope this helps.