note 98024 deleted from function.mysql-real-escape-string by danbrown

Note Submitter: orwellophile at php dot spamtrak dot org 

----

Here is a userland replacement for the generic mysql_escape_string (I have a server which generates SQL but doesn't have MySQL libraries).

<?

   /** 
     * @brief mysql_escape_string implementation
     * Replaces \x00, \n, \r, \,  ',   " and \x1a
     * with:    \0,   \n, \r, \\, \', \" and \Z
     * @param $string string to be escaped
     * 
     * @return escaped string
     */
   function sql_escape($string) {
      $search = array("\\", "\x00", "\n", "\r", "'", "\"", "\x1a");
      $replace = array("\\\\", '\0', '\n', '\r', "\\'", '\"', '\Z');
      return str_replace($search, $replace, $string);
   }

   # Test Harness
   if (!empty($argc) && basename($argv[0]) == basename(__FILE__)) {
      $string = "mysql_escape_string replaces \x00, \n, \r, \, ', \" and \x1a.";
      printf("mysql_escape_string: %s\n", mysql_escape_string($string));
      printf("sql_escape:          %s\n", sql_escape($string));
   }
   
   # mysql_escape_string: mysql_escape_string replaces \0, \n, \r, \\, \', \" and \Z.
   # sql_escape:          mysql_escape_string replaces \0, \n, \r, \\, \', \" and \Z.
?>