note 40955 deleted from function.mysql-escape-string by aidan

Note Submitter: nick at spam me not careercast dot com ---- Regarding the function submitted by: vladimir-dozen at mail dot ru You've made your life much more difficult than it needs to be. :-) Instead of your complicated printf solution, the following is completely secure: $query = "DELETE FROM user WHERE id='" . mysql_escape_string($id) . "'" Just use single quotes around the data, even if it is an int column. Then even if the user passes a "5 or 1=1", the following will be sent to mysql: DELETE FROM user WHERE id='5 or 1=1'; And the query will fail.