note 35526 deleted from function.mysql-escape-string by didou

Note Submitter: homer400@yahoo.NOSPAM.com ---- Make a class that encapsulates all db access that includes string escaping. Currently I am using this type of approach: <? $query = GetDataQuery("INSERT INTO #articles (CategoryID, UserID, CreatedOn, UpdatedOn, Title, Description, ArticleText) VALUES (?,?,NOW(),NOW(),?,?,?)"); $query->setParams($CategoryID, $UserID, $Article[Title], $Article[Description], $ArticleArray[UnparsedArticle]); $query->Execute(); ?> The great thing about it is that I can change my table prefix very easily, all my parameters are escaped, the class doesn't rely on Default connections handles, and mysql_select_db is used on every call. If you are worried about doubled slashes saved in your db, you can call mysql_real_escape_string(stripslashes($string), $this->linkDatabase) in your execute.