Search Result

srbakshi · May 22 '09, 09:06 AM

Hey all,
I'm stuck with the following:

The mysql_real_esca pe_string(conn, to, from, strlen(from)) function does not return the escaped string. So how can I go about writing a wrapper for it so that it RETURNS the 'to' string which in turn helps me fill out a query in the following manner using sprintf:

Code:

unescaped_query = "INSERT into MYTABLE values ('%s', '%s')";
sprintf(escaped_query, unescaped_query,

...

srbakshi · May 18 '09, 10:24 AM

Hi all. I picked up the following code example from the php manual:

Code:

$link = mysql_connect('mysql_host', 'mysql_user', 'mysql_password')
    OR die(mysql_error());

// Query
$query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
            mysql_real_escape_string($user),
            mysql_real_escape_string($password));

My question is, shouldn't we be escaping...

Search Result

mysql_real_escape_string wrapper problem!

When should special characers be escaped inside strings?