note 55912 added to function.mysql-real-escape-string
| From: | frankatvanwensveen_dot_nl at osu1 dot php dot net | Date: | Wed, 17 Aug 2005 14:04:13 +0000 |
| Subject: | note 55912 added to function.mysql-real-escape-string | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-93792@lists.php.net to get a copy of this message | ||
I'm not an experienced PHP or SQL programmer yet (working on it, though) so this is probably a
real newbie question.
I'm currently in the process of making existing (non-secure) newbie code more secure. It seems
a bit of a pain to revise this code and go trough it line by line to apply
mysql_real_escape_string() to each SQL query separately.
I'd rather do this once, in the code layer I put between my PHP code and the underlying SQL
database.
For example, I call a function db_query() that passes on the query to mysql_query(). When I decided
to to it that way the idea was that I could not only insert debugging code there (being in the
learn-as-you-mess-up stage as I am) but also that one day I might have to apply existing code to
another SQL database instead of MySQL.
Question: is it possible to just apply mysql_real_escape_string() to the entire query string in this
interface layer, regardless of what that query string is, and thereby take care of all my pains,
woes and worries in one fells swoop? (That seems too good to be true so it probably is... <g>)
Any response would be appreciated!
----
Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+55912
Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+55912&report=yes&reason=added+to+the+manual
Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+55912&report=yes&reason=bad+code
Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+55912&report=yes&reason=spam
Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+55912&report=yes&reason=useless
Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+55912&report=yes&reason=non-english
Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+55912&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+55912&report=yes
Search -- http://master.php.net/manage/user-notes.php