PHP gurus...help please!

[sarettah]

Originally Posted by Toby

Grrrr, having trouble getting the board to display that snippet properly. the (’) should be ( & #146; ) without the space.



Right, the chosen replacement string may still cause problems depending on how the strings are used when displayed.

Well that and if they are coming directly from the form she needs to protect against sql injection too, if that is not already happening.

I hate dealing with escapes, so I write my code to deal with them as little as possible..lol. It is the one thing about php that I don't like compared to the other languages I deal with.

My standard way of dealing with this shit if I have to is..

1. turn on mysql at the beginning of the script.
2. run all input vars through mysql_real_escape_string
3. run all input vars through addslashes
4. Stick them into the database

so.. like this

mysql_pconnect($mysql_host,$mysql_user,$mysql_ass) ;
mql_select_db($mysql_db);

$input_var=addslashes(mysql_real_escape_string($_P OST['input_var']));
$result=mysql_query("insert into database.tablename(field2insertinto)values(" . $input_var . ")");

But if the only thing I am dealing with is a single quote prob because it is a protected form or because I am doing an update routine that is not form fed then I just used the replace a single quote with 2 single quotes like I said orignally