Re: addslashes/mysql_real_escape_string
Again I appreciate your replies.
I guess I chose the wrong words before, probably because I knew what I
meant and expected that everybody else would as well. Now, as none is
capable of mind reading, this is not so. ;)
I just tested the "best practices" code from the php manual and it did
what I expected it to - that is, not modifying the data and submitting
it to the db unaltered. So if I were to submit data to a db, a string
containing "jnjsdf'jn/ljknv\knns", it would be submitted to the db as
such and I could retrieve it without the need to strip the string from
any sort of characters, right? At least so it seems from following code:
<form method="post" action="">
Title:
<input name="title" type="text" /><br />
Text:
<input name="text" type="text" /><br />
<input name="submit" type="submit" value="submit" /><br />
<input type="submit" name="getDbEntry" value="Get" /><br />
</form>
<?php
require_once('incl/DbConnector.php');
$connector = new DbConnector();
function secQuotes($value){
if(get_magic_quotes_gpc()){
$value = stripslashes($value);
}
$value = mysql_real_escape_string($value);
return $value;
}
if(isset($_POST['submit'])){
if(!empty($_POST['title']) and !empty($_POST['text'])){
$query = "INSERT INTO test (title, text) VALUES ('"
. secQuotes($_POST['title'])
."', '"
. secQuotes($_POST['text'])
."')";
$connector->insert($query);
}
}
if(isset($_POST['getDbEntry'])){
$result = $connector->query("SELECT * FROM test");
while($row = $connector->fetchArray($result)){
echo 'ID: '.$row['id']."\n".'<br />';
echo 'Title: '.$row['title']."\n".'<br />';
echo 'Article: '.$row['text']."\n".'<br />';
}
}
?>
Again, I might be wrong on this, feel free to elaborate.
Regards
ndlarsen
|