RE: MySql injections (related question)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



> -----Original Message-----
> From: Richard Lynch [mailto:ceo@xxxxxxxxx]
> Sent: Thursday, May 12, 2005 8:47 AM

> I'd bet a dollar that if the MySQL C Client library changed what needs
> escaping, addslashes would change with it.

Ehhh? I think not. Let´s let a mindgame (can´t spell hypo..whatever :-) and say that the MySQL folk figures out they wanna use the same way for escaping as PostgreSQL, then addslashes() would add ' ? The whole idea of nameconvention is gone then :-)

But I do agree with You, need to hear *WHY* the mysql_real_escape_string() is better (and a so fu****' long word :)

> What problem do you think addslashes() was written to solve?

For those who has magic qoutes off? I still can figure out why some people hate that setting so much? Though one´s not safe with only magic quotes, addslashes() are needed too...

--
Med venlig hilsen / best regards
ComX Networks A/S
Kim Madsen
Systemudvikler/Systemdeveloper

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux