On 20/08/10 08:05, Karl DeSaulniers wrote:
On Aug 19, 2010, at 4:44 PM, Karl DeSaulniers wrote:
On Aug 19, 2010, at 4:36 PM, Daevid Vincent wrote:
You should be using
http://us2.php.net/manual/en/function.mysql-escape-string.php
You don't need to search with extra slashes for retrieval.
-----Original Message-----
From: Karl DeSaulniers [mailto:k...@designdrumm.com]
Sent: Thursday, August 19, 2010 2:29 PM
To: php-db@lists.php.net
Subject: [PHP-DB] Slashes or no slashes
Hello,
When I add an item to my database and I use addslashes(),
do I have to use addslashes() to a query that looks for that item?
Or would I be adding double slashes and canceling my own result?
TIA
Karl DeSaulniers
Design Drumm
http://designdrumm.com
-- PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Ah, but lets say I am using a character set utf-8, I should use
mysql_real_escape_string() instead?
Best,
Karl DeSaulniers
Design Drumm
http://designdrumm.com
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
For a line like this..
return htmlspecialchars(stripslashes($this->values[$field]));
would I change this to?
return mysql_real_escape_string($this->values[$field]);
Or do I still need the htmlspecialchars? In that case would I change it to?
return htmlspecialchars(mysql_real_escape_string($this->values[$field]));
You use mysql_real_escape_string for queries on the way in.
$query = "select * from table where
name='".mysql_real_escape_string($_POST['name'])."'";
You use htmlspecialchars on the way out:
$value = htmlspecialchars($row['name']);
--
Postgresql & php tutorials
http://www.designmagick.com/
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
