note 46910 added to security.database.sql-injection

The suggestion to use addslashes() instead of a database specific escape string type function (e.g. mysql_escape_string(), mysql_real_escape_string(), pg_escape_string()) directly conflicts with information listed on the escape string function pages. From the pg_escape_string manual: "pg_escape_string() escapes string for text/char datatype. It returns escaped string for PostgreSQL. Use of this function is recommended instead of addslashes()." However, not every database has a built in escape string function (ie. there is no mssql_escape_string() for MS SQL databases at this time), so using such databases require the use of addslashes() to escape data. I should also note that if you have your magic quotes turned on, you shouldn't need to use addslashes(), and doing so will add extra slashes to your text. ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+46910 Delete -- http://master.php.net/manage/user-notes.php?action=delete+46910&report=yes Reason: bad code -- http://master.php.net/manage/user-notes.php?action=delete+46910&report=yes&reason=bad+code Reason: spam -- http://master.php.net/manage/user-notes.php?action=delete+46910&report=yes&reason=spam Reason: useless example -- http://master.php.net/manage/user-notes.php?action=delete+46910&report=yes&reason=useless+example Reason: contains commercial links -- http://master.php.net/manage/user-notes.php?action=delete+46910&report=yes&reason=contains+commercial+links Reason: useless note -- http://master.php.net/manage/user-notes.php?action=delete+46910&report=yes&reason=useless+note Reject -- http://master.php.net/manage/user-notes.php?action=reject+46910&report=yes Search -- http://master.php.net/manage/user-notes.php