Re: [PHP-DB] Slashes or no slashes

On 20/08/10 08:05, Karl DeSaulniers wrote:
>
> On Aug 19, 2010, at 4:44 PM, Karl DeSaulniers wrote:
>
>> On Aug 19, 2010, at 4:36 PM, Daevid Vincent wrote:
>>
>>> You should be using
>>> http://us2.php.net/manual/en/function.mysql-escape-string.php
>>>
>>> You don't need to search with extra slashes for retrieval.
>>>
>>>> -----Original Message-----
>>>> From: Karl DeSaulniers [mailto:[email protected]]
>>>> Sent: Thursday, August 19, 2010 2:29 PM
>>>> To: [email protected]
>>>> Subject: [PHP-DB] Slashes or no slashes
>>>>
>>>> Hello,
>>>> When I add an item to my database and I use addslashes(),
>>>> do I have to use addslashes() to a query that looks for that item?
>>>> Or would I be adding double slashes and canceling my own result?
>>>> TIA
>>>>
>>>> Karl DeSaulniers
>>>> Design Drumm
>>>> http://designdrumm.com
>>>>
>>>>
>>>
>>>
>>> -- PHP Database Mailing List (http://www.php.net/)
>>> To unsubscribe, visit: http://www.php.net/unsub.php
>>>
>>
>>
>> Ah, but lets say I am using a character set utf-8, I should use
>> mysql_real_escape_string() instead?
>> Best,
>>
>> Karl DeSaulniers
>> Design Drumm
>> http://designdrumm.com
>>
>>
>> --
>> PHP Database Mailing List (http://www.php.net/)
>> To unsubscribe, visit: http://www.php.net/unsub.php
>>
>
>
> For a line like this..
>
> return htmlspecialchars(stripslashes($this->values[$field]));
>
> would I change this to?
>
> return mysql_real_escape_string($this->values[$field]);
>
> Or do I still need the htmlspecialchars? In that case would I change it to?
>
> return htmlspecialchars(mysql_real_escape_string($this->values[$field]));

You use mysql_real_escape_string for queries on the way in.

$query = "select * from table where 
name='".mysql_real_escape_string($_POST['name'])."'";

You use htmlspecialchars on the way out:

$value = htmlspecialchars($row['name']);


-- 
Postgresql & php tutorials
http://www.designmagick.com/