note 14907 deleted from function.mysql-escape-string by aidan
| From: | aidan@php.net | Date: | Wed, 11 Aug 2004 14:09:04 +0000 |
| Subject: | note 14907 deleted from function.mysql-escape-string by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-74460@lists.php.net to get a copy of this message | ||
Note Submitter: idiot@users.sourceforge.net
----
The point of using mysql_escape_string() is so that malicious users can't supply an evil string
that causes mysql to do evil things. Imagine if somebody typed in their username to your website as
something like:<br><br> MrUser"; DROP DATABASE mysql <br><br>
mysql_escape_string() defeats this attack.