When writing PHP web apps, I tend to run in to a portability issue when dealing with SQL connectivity. Since I can’t count on having the PEAR DB module available, I rolled my own set of functions to interact with a MySQL database.<\/p>\n
The problem lies in escaping characters in your SQL queries. Do I My quick-and-dirty solution is the following function:<\/p>\n By calling that function on every page that deals with inserting content in to the database, I know will will get my content escaped correctly.<\/p>\n Of course it escapes all submitted content, including that which isn’t going in to the database so don’t forget to Example: $notes = $_REQUEST['notes ']; $SQL = \"INSERT INTO notes (note) VALUES ('$notes')\"; print \"Your note was: $confirmation\"; When writing PHP web apps, I tend to run in to a portability issue when dealing with SQL connectivity. Since I can’t count on having the PEAR DB module available, I rolled my own set of functions to interact with … Continue reading addslashes()<\/code>? Is magic_quotes_gpc enabled?<\/p>\n
\nfunction request_cleanup()
\n{
\n if(get_magic_quotes_gpc() == 0)
\n {
\n foreach($_REQUEST as $req_key => $req_value)
\n {
\n $_REQUEST[$req_key]=addslashes($_REQUEST[$req_key]);
\n }
\n }
\n}
\n<\/code><\/p>\nstripslashes()<\/code> when you are working with data that doesn’t need it.<\/p>\n
\n
\nrequest_cleanup();<\/p>\n
\n$confirmation = stripslashes($_REQUEST['notes ']);<\/p>\n
\nsql_proc($SQL);<\/p>\n
\n<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"