Re: Sanitizing potential MySQL strings with no database connection

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Dotan Cohen wrote:
> 2009/10/20 Andrea Giammarchi <an_red@xxxxxxxxxxx>:
>> even better
>>
>> $error_reporting = error_reporting(0);
>> if(mysql_real_escape_string($variable) === false)
>> {
>>     error_reporting($error_reporting);
>>
>>     // create a default DB connection
>>
>> } else
>>     error_reporting($error_reporting);
>> unset($error_reporting);
>>
> 
> Thanks, I will try that this evening. I may not have permissions for
> that, but we'll see.
> 

I stole this from ZF:

function dotan_real_escape_string($value)
{
	if (is_int($value)) {
		return $value;
	} elseif (is_float($value)) {
		return sprintf('%F', $value);
	}
	return "'" . addcslashes($value, "\000\n\r\\'\"\032") . "'";
}

-- 
Thanks!
-Shawn
http://www.spidean.com

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux