Can anyone tell me what it do? They say this is to avoid SQL injection and so on. is it true?
Tags: Mysql_real_escape_string
Can anyone tell me what it do? They say this is to avoid SQL injection and so on. is it true?
Tags: Mysql_real_escape_string
June 8th, 2009 at 1:23 pm
This function is used for escaping data to be sent to a MySQL database:
mysql_real_escape_string( $string, $db_link );
$db_link should be the variable that holds the link identifier the MySQL database you’ve connected to.
What is better about this function than mysql_escape_string() or the improperly used add_slashes() is that it will use the character set of the current database connection.
This does help protect against SQL injection and other possible forms of attack.
June 8th, 2009 at 7:56 pm
It will escape special characters. Say you have a textbox and they try to submit database query commands, it could really mess up your table/database or give them control of it.
More info here:http://us3.php.net/mysql_real_escape_str…