Mysql_real_escape_string?

Author: admin  //  Category: SQl Injection

Can anyone tell me what it do? They say this is to avoid SQL injection and so on. is it true?

Tags:

2 Responses to “Mysql_real_escape_string?”

  1. Andy Stratton Says:

    This function is used for escaping data to be sent to a MySQL database:
    mysql_real_escape_string( $string, $db_link );
    $db_link should be the variable that holds the link identifier the MySQL database you’ve connected to.
    What is better about this function than mysql_escape_string() or the improperly used add_slashes() is that it will use the character set of the current database connection.
    This does help protect against SQL injection and other possible forms of attack.

  2. 8bithero Says:

    It will escape special characters. Say you have a textbox and they try to submit database query commands, it could really mess up your table/database or give them control of it.
    More info here:http://us3.php.net/mysql_real_escape_str…

Leave a Reply