note 46910 deleted from security.database.sql-injection by sean

Note Submitter: chris AT sketchdiary DOT nospam DOT com ---- The suggestion to use addslashes() instead of a database specific escape string type function (e.g. mysql_escape_string(), mysql_real_escape_string(), pg_escape_string()) directly conflicts with information listed on the escape string function pages. From the pg_escape_string manual: "pg_escape_string() escapes string for text/char datatype. It returns escaped string for PostgreSQL. Use of this function is recommended instead of addslashes()." However, not every database has a built in escape string function (ie. there is no mssql_escape_string() for MS SQL databases at this time), so using such databases require the use of addslashes() to escape data. I should also note that if you have your magic quotes turned on, you shouldn't need to use addslashes(), and doing so will add extra slashes to your text. ---- Reason: incoporating into manual