PHP gurus...help please!

[sarettah]

Originally Posted by sarettah

Well that and if they are coming directly from the form she needs to protect against sql injection too, if that is not already happening.

I hate dealing with escapes, so I write my code to deal with them as little as possible..lol. It is the one thing about php that I don't like compared to the other languages I deal with.

My standard way of dealing with this shit if I have to is..

1. turn on mysql at the beginning of the script.
2. run all input vars through mysql_real_escape_string
3. run all input vars through addslashes
4. Stick them into the database

so.. like this

mysql_pconnect($mysql_host,$mysql_user,$mysql_ass) ;
mql_select_db($mysql_db);

$input_var=addslashes(mysql_real_escape_string($_P OST['input_var']));
$result=mysql_query("insert into database.tablename(field2insertinto)values(" . $input_var . ")");

But if the only thing I am dealing with is a single quote prob because it is a protected form or because I am doing an update routine that is not form fed then I just used the replace a single quote with 2 single quotes like I said orignally

I have that all fucked up dammit.

Helps to have coffee first.

Should not need the addslashes if I am using the mysql_real_escape as it will do the same fucking thing.

Hate when I screw that shit up.