note 30896 deleted from function.mysql-escape-string by aidan

Note Submitter: sp4m_only@hotmail.com ---- I found out another very curious thing about both AddSlashes() and mysql_escape_string(). It seems that for mysql, the string '##' has some special meaning. Someone told me it might be the beginning of a comment line in the SQL statement. In any case, there is only ONE #-char inserted into the database, instead of two. The two escape functions DO NOT escape this two-char-sequence. So if you want to insert an image in the database and be SURE the image is not f#ck#d up, then do the escaping yourself: $filedata = str_replace('##', '\#\#', mysql_escape_string($filedata)); $query = "insert into IMAGES (IMAGE) values ($filedata)"; $result = mysql_query($query); I hope this will save you guys the ours that I spent by searching for the bug in my own code...