note 44527 deleted from function.mysql-escape-string by tomsommer
| From: | tomsommer@php.net | Date: | Mon, 09 Aug 2004 05:27:57 +0000 |
| Subject: | note 44527 deleted from function.mysql-escape-string by tomsommer | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-74285@lists.php.net to get a copy of this message | ||
Note Submitter: engine2 at intrastore dot cdc dot com
----
It just bit me: escaping more than one. I had a statement like:
$result = mysql_query(mysql_escape_string($query), $db);
And I was getting 1064 from MySQL. After an insane amount of tracing (when I printed the resultant
SQL and pasted it at mysql> everything worked!...) I finally found a reason: I was
validating/escaping user input before it got to the statement above. Some things were escaped twice,
and MySQL went "Huh?!". So watch out for that...