my_real_escape_string problem

[mun]

when magic_quotes_gp c = off, what is the difference between
addslashes($var ) and my_real_escape_ string($var).

I use a function from php manual like this:

function quote_smart($va lue)
{
// Stripslashes
if (get_magic_quot es_gpc()) {
$value = stripslashes($v alue);
}
// Quote if not integer
if (!is_numeric($v alue)) {
$value = " ' " . mysql_real_esca pe_string($valu e) . " ' ";
}
return $value;
}


I use it with a select query like this: "select * from table where id
= ".quote_smart($ _GET["id"]) and it doesn't work (no result returned).
But when I replace the quote_smart function with the normal addslashes
function, it works. (my default magic_quotes_gp c = off)

[Man-wai Chang]

Re: my_real_escape_ string problem

function quote_smart($va lue)

{
// Stripslashes
if (get_magic_quot es_gpc()) {
$value = stripslashes($v alue);
But when I replace the quote_smart function with the normal addslashes
function, it works. (my default magic_quotes_gp c = off)

You talking about "add" or "strip"?

--
iTech Consulting Co., Ltd.
Expert of ePOS solutions
Website: http://www.itech.com.hk (IE only)
Tel: (852)2325 3883 Fax: (852)2325 8288

[Jerry Stuckle]

Re: my_real_escape_ string problem

mun wrote:

when magic_quotes_gp c = off, what is the difference between
addslashes($var ) and my_real_escape_ string($var).
>
I use a function from php manual like this:
>
function quote_smart($va lue)
{
// Stripslashes
if (get_magic_quot es_gpc()) {
$value = stripslashes($v alue);
}
// Quote if not integer
if (!is_numeric($v alue)) {
$value = " ' " . mysql_real_esca pe_string($valu e) . " ' ";
}
return $value;
}
>
>
I use it with a select query like this: "select * from table where id
= ".quote_smart($ _GET["id"]) and it doesn't work (no result returned).
But when I replace the quote_smart function with the normal addslashes
function, it works. (my default magic_quotes_gp c = off)
>

RTFM. mysql_real_esca pe_string() is charset sensitive. addslashes() is not.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

[Toby A Inkster]

Re: my_real_escape_ string problem

mun wrote:

function quote_smart($va lue)
{
// Stripslashes
if (get_magic_quot es_gpc()) {
$value = stripslashes($v alue);
}
// Quote if not integer
if (!is_numeric($v alue)) {
$value = " ' " . mysql_real_esca pe_string($valu e) . " ' ";
}
return $value;
}

Code defensively...

function quote_smart ($value)
{
if (is_numeric($va lue))
return $value;

if (get_magic_quot es_gpc())
$value = stripslashes($v alue);

if (function_exist s('mysql_real_e scape_string'))
return mysql_real_esca pe_string($valu e);

trigger_error(" mysql_real_esca pe_string function does not exist!");
return addslashes($val ue);
}

Does that work OK? Try it a few times. Now check your PHP error log and
see if a surprise message awaits!

--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~ http://tobyinkster.co.uk/contact
Geek of ~ HTML/SQL/Perl/PHP/Python*/Apache/Linux

* = I'm getting there!

[mun]

Re: my_real_escape_ string problem

On Mar 19, 6:04 am, Toby A Inkster <usenet200...@t obyinkster.co.u k>
wrote:

mun wrote:

function quote_smart($va lue)
{
// Stripslashes
if (get_magic_quot es_gpc()) {
$value = stripslashes($v alue);
}
// Quote if not integer
if (!is_numeric($v alue)) {
$value = " ' " . mysql_real_esca pe_string($valu e) . " ' ";
}
return $value;
}

>
Code defensively...
>
function quote_smart ($value)
{
if (is_numeric($va lue))
return $value;
>
if (get_magic_quot es_gpc())
$value = stripslashes($v alue);
>
if (function_exist s('mysql_real_e scape_string'))
return mysql_real_esca pe_string($valu e);
>
trigger_error(" mysql_real_esca pe_string function does not exist!");
return addslashes($val ue);
>
}
>
Does that work OK? Try it a few times. Now check your PHP error log and
see if a surprise message awaits!
>
--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~http://tobyinkster.co.uk/contact
Geek of ~ HTML/SQL/Perl/PHP/Python*/Apache/Linux
>
* = I'm getting there!

I am sorry for my late reply. I will try the function and let you know.