Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!eternal-september.org!feeder.eternal-september.org!mx04.eternal-september.org!.POSTED!not-for-mail From: "Peter H. Coffin" Newsgroups: comp.lang.php Subject: Re: Data sanitation for mysql queries. Date: Sat, 17 Nov 2012 19:47:57 -0600 Organization: A noiseless patient Spider Lines: 14 Message-ID: References: <56c7dfc2-c368-4403-8d7d-19233367f2c2@googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Injection-Info: mx04.eternal-september.org; posting-host="95eff61b8f8136989e561408eae2762f"; logging-data="1357"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+WQwWa23glEz03OZhrhEgS" User-Agent: slrn/0.9.9p1 (OpenBSD) Cancel-Lock: sha1:UoQqNSRC3p7E9i9oB+F5PXHLmyo= Xref: csiph.com comp.lang.php:7618 On Fri, 16 Nov 2012 11:36:18 -0800 (PST), cph wrote: > I am not asking about validation that is a whole other topic. This is > specifically about sanitation. The problem with real_escape_string is > from what I have read its not good enough to prevent sql injections. Where did you read that? It's better than add_slashes because it's actually AWARE of the connection parameters, like what the actual escape character is. -- 54. I will not strike a bargain with a demonic being then attempt to double-cross it simply because I feel like being contrary. --Peter Anspach's list of things to do as an Evil Overlord