Ahhh.. Kapu where were you three months ago?? :)
Prepared statements sounds like the way to go,
but at this point that would mean converting a lot of pages.
I will have to investigate some more about this and convert the code
over at a later date.
For now I think mysql_real_escape_string will work for what I am doing.
Thank you all for your responses. Again.
Best,
Karl
On Aug 19, 2010, at 5:40 PM, <kapuoriginal@xxxxxxxxx> wrote:
I think you should use prepared statements.
Kapu
--------------------------------------------------
From: "Karl DeSaulniers" <karl@xxxxxxxxxxxxxxx>
Sent: Friday, August 20, 2010 12:05 AM
To: <php-db@xxxxxxxxxxxxx>
Subject: Re: Slashes or no slashes
On Aug 19, 2010, at 4:44 PM, Karl DeSaulniers wrote:
On Aug 19, 2010, at 4:36 PM, Daevid Vincent wrote:
You should be using
http://us2.php.net/manual/en/function.mysql-escape-string.php
You don't need to search with extra slashes for retrieval.
-----Original Message-----
From: Karl DeSaulniers [mailto:karl@xxxxxxxxxxxxxxx]
Sent: Thursday, August 19, 2010 2:29 PM
To: php-db@xxxxxxxxxxxxx
Subject: Slashes or no slashes
Hello,
When I add an item to my database and I use addslashes(),
do I have to use addslashes() to a query that looks for that item?
Or would I be adding double slashes and canceling my own result?
TIA
Karl DeSaulniers
Design Drumm
http://designdrumm.com
-- PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Ah, but lets say I am using a character set utf-8, I should use
mysql_real_escape_string() instead?
Best,
Karl DeSaulniers
Design Drumm
http://designdrumm.com
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
For a line like this..
return htmlspecialchars(stripslashes($this->values[$field]));
would I change this to?
return mysql_real_escape_string($this->values[$field]);
Or do I still need the htmlspecialchars? In that case would I
change it to?
return htmlspecialchars(mysql_real_escape_string($this->values
[$field]));
TIA
Karl DeSaulniers
Design Drumm
http://designdrumm.com
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Karl DeSaulniers
Design Drumm
http://designdrumm.com
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
