This function is used for escaping data to be sent to a MySQL database:
mysql_real_escape_string( $string, $db_link );
$db_link should be the variable that holds the link identifier the MySQL database you’ve connected to.
What is better about this function than mysql_escape_string() or the improperly used add_slashes() is that it will use the character set of the current database connection.
This does help protect against SQL injection and other possible forms of attack.
It will escape special characters. Say you have a textbox and they try to submit database query commands, it could really mess up your table/database or give them control of it.
More info here:http://us3.php.net/mysql_real_escape_str…
June 8th, 2009 at 1:23 pm
This function is used for escaping data to be sent to a MySQL database:
mysql_real_escape_string( $string, $db_link );
$db_link should be the variable that holds the link identifier the MySQL database you’ve connected to.
What is better about this function than mysql_escape_string() or the improperly used add_slashes() is that it will use the character set of the current database connection.
This does help protect against SQL injection and other possible forms of attack.
June 8th, 2009 at 7:56 pm
It will escape special characters. Say you have a textbox and they try to submit database query commands, it could really mess up your table/database or give them control of it.
More info here:http://us3.php.net/mysql_real_escape_str…