Re: [PHP-DB] Slashes or no slashes

On Aug 19, 2010, at 4:44 PM, Karl DeSaulniers wrote:

> On Aug 19, 2010, at 4:36 PM, Daevid Vincent wrote:
>
>> You should be using
>> http://us2.php.net/manual/en/function.mysql-escape-string.php
>>
>> You don't need to search with extra slashes for retrieval.
>>
>>> -----Original Message-----
>>> From: Karl DeSaulniers [mailto:[email protected]]
>>> Sent: Thursday, August 19, 2010 2:29 PM
>>> To: [email protected]
>>> Subject: [PHP-DB] Slashes or no slashes
>>>
>>> Hello,
>>> When I add an item to my database and I use addslashes(),
>>> do I have to use addslashes() to a query that looks for that item?
>>> Or would I be adding double slashes and canceling my own result?
>>> TIA
>>>
>>> Karl DeSaulniers
>>> Design Drumm
>>> http://designdrumm.com
>>>
>>>
>>
>>
>> -- PHP Database Mailing List (http://www.php.net/)
>> To unsubscribe, visit: http://www.php.net/unsub.php
>>
>
>
> Ah, but lets say I am using a character set utf-8, I should use  
> mysql_real_escape_string() instead?
> Best,
>
> Karl DeSaulniers
> Design Drumm
> http://designdrumm.com
>
>
> -- 
> PHP Database Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>


For a line like this..

return htmlspecialchars(stripslashes($this->values[$field]));

would I change this to?

return mysql_real_escape_string($this->values[$field]);

Or do I still need the htmlspecialchars? In that case would I change  
it to?

return htmlspecialchars(mysql_real_escape_string($this->values 
[$field]));

TIA

Karl DeSaulniers
Design Drumm
http://designdrumm.com