note 40955 added to function.mysql-escape-string

Regarding the function submitted by: vladimir-dozen at mail dot ru You've made your life much more difficult than it needs to be. :-) Instead of your complicated printf solution, the following is completely secure: $query = "DELETE FROM user WHERE id='" . mysql_escape_string($id) . "'" Just use single quotes around the data, even if it is an int column. Then even if the user passes a "5 or 1=1", the following will be sent to mysql: DELETE FROM user WHERE id='5 or 1=1'; And the query will fail. ---- Manual Page -- http://www.php.net/manual/en/function.mysql-escape-string.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+40955 Delete -- http://master.php.net/manage/user-notes.php?action=delete+40955&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+40955&report=yes Search -- http://master.php.net/manage/user-notes.php