Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Arno Welzel <usenet@arnowelzel.de>
Newsgroups: comp.lang.php
Subject: Re: PHP sql entry is a godaweful mess
Date: Wed, 04 Dec 2013 17:15:01 +0100
Lines: 40
Message-ID: <529F5505.7090501@arnowelzel.de>
References: <MPG.2d0923e0848f8339896b9@news.virginmedia.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Trace: individual.net WaZHUQiX83sgVUpv771DKQlVF/cEQWljABrXEI264VL+8z6DxV
Cancel-Lock: sha1:GcnNsor/LngG7ecunRQNhvev27s=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.1.1
In-Reply-To: <MPG.2d0923e0848f8339896b9@news.virginmedia.com>
Xref: csiph.com comp.lang.php:12131

Am 04.12.2013 12:35, schrieb bored@now.com:

> I've just decided to update some code so updated myself with the docs
> for mySQL entry cleaning and frankly I am totally confused.
> 
> Can someone point to a very clear and unambigous instruction
> as to how to safely enter data into a mysql database?
> Because I doubt thats even possible with PHP.

It is - just do NOT use mysql but mysqli or PDO.

> We have to contend with stripslashes, magic_quotes, magic_quotes_sybase
> mysql_escape_string, mysql_real_escape_string  and more...

No - you don't have to.

See:

<http://php.net/manual/en/class.mysqli.php>
<http://www.php.net/manual/en/mysqli.prepare.php>
<http://php.net/manual/en/book.pdo.php>
<http://php.net/manual/en/pdo.prepare.php>

> As for mysqli and its unnecessarily obtuse syntax... well I'll be 
> looking for alternatives.

Obtuse syntax? Why?

Maybe you got confused by the fact, that mysqli comes in two flavors:
Procedural - to make it easier to migrate existing code from mysql - and
object oriented.

See <http://php.net/manual/en/mysqli.quickstart.dual-interface.php>



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de