note 55912 added to function.mysql-real-escape-string

From: Date: Wed, 17 Aug 2005 14:04:13 +0000
Subject: note 55912 added to function.mysql-real-escape-string
Groups: php.notes 
Request: Send a blank email to php-notes+get-93792@lists.php.net to get a copy of this message
I'm not an experienced PHP or SQL programmer yet (working on it, though) so this is probably a real newbie question. I'm currently in the process of making existing (non-secure) newbie code more secure. It seems a bit of a pain to revise this code and go trough it line by line to apply mysql_real_escape_string() to each SQL query separately. I'd rather do this once, in the code layer I put between my PHP code and the underlying SQL database. For example, I call a function db_query() that passes on the query to mysql_query(). When I decided to to it that way the idea was that I could not only insert debugging code there (being in the learn-as-you-mess-up stage as I am) but also that one day I might have to apply existing code to another SQL database instead of MySQL. Question: is it possible to just apply mysql_real_escape_string() to the entire query string in this interface layer, regardless of what that query string is, and thereby take care of all my pains, woes and worries in one fells swoop? (That seems too good to be true so it probably is... <g>) Any response would be appreciated! ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+55912 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+55912&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+55912&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+55912&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+55912&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+55912&report=yes&reason=non-english Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+55912&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+55912&report=yes Search -- http://master.php.net/manage/user-notes.php

« previous php.notes (#93792) next »