note 48745 deleted from function.addslashes by nlopess
| From: | nlopess@php.net | Date: | Sat, 24 Sep 2005 07:49:27 +0000 |
| Subject: | note 48745 deleted from function.addslashes by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-95682@lists.php.net to get a copy of this message | ||
Note Submitter: josh at gitlinfamily dot com
----
Here's a (very simple) way to determine if a string needs to be escaped by addslashes:
<?php
function string_needs_addslashes($str)
{
if (($qp = strpos($str,'\'')) !== false)
{
if ($sp<1 || $str[$qp-1] != '\\')
return true;
else
return string_needs_addslashes(substr($str,$sp+1));
}
return false;
}
?>
The theory being, if a single quote is found and is not prefaced by a slash, then the string is not
safe and needs to be escaped before database entry.