note 55912 deleted from function.mysql-real-escape-string by victor

Note Submitter: frank at vanwensveen_dot_nl ---- I'm not an experienced PHP or SQL programmer yet (working on it, though) so this is probably a real newbie question. I'm currently in the process of making existing (non-secure) newbie code more secure. It seems a bit of a pain to revise this code and go trough it line by line to apply mysql_real_escape_string() to each SQL query separately. I'd rather do this once, in the code layer I put between my PHP code and the underlying SQL database. For example, I call a function db_query() that passes on the query to mysql_query(). When I decided to to it that way the idea was that I could not only insert debugging code there (being in the learn-as-you-mess-up stage as I am) but also that one day I might have to apply existing code to another SQL database instead of MySQL. Question: is it possible to just apply mysql_real_escape_string() to the entire query string in this interface layer, regardless of what that query string is, and thereby take care of all my pains, woes and worries in one fells swoop? (That seems too good to be true so it probably is... <g>) Any response would be appreciated!