View Single Post

  #9 (permalink)  
Old 03-27-2008
ndlarsen
 
Posts: n/a
Default Re: addslashes/mysql_real_escape_string

Again I appreciate your replies.
I guess I chose the wrong words before, probably because I knew what I
meant and expected that everybody else would as well. Now, as none is
capable of mind reading, this is not so. ;)
I just tested the "best practices" code from the php manual and it did
what I expected it to - that is, not modifying the data and submitting
it to the db unaltered. So if I were to submit data to a db, a string
containing "jnjsdf'jn/ljknv\knns", it would be submitted to the db as
such and I could retrieve it without the need to strip the string from
any sort of characters, right? At least so it seems from following code:

<form method="post" action="">

Title:
<input name="title" type="text" /><br />
Text:
<input name="text" type="text" /><br />
<input name="submit" type="submit" value="submit" /><br />
<input type="submit" name="getDbEntry" value="Get" /><br />
</form>

<?php

require_once('incl/DbConnector.php');

$connector = new DbConnector();

function secQuotes($value){

if(get_magic_quotes_gpc()){
$value = stripslashes($value);
}

$value = mysql_real_escape_string($value);

return $value;

}

if(isset($_POST['submit'])){

if(!empty($_POST['title']) and !empty($_POST['text'])){

$query = "INSERT INTO test (title, text) VALUES ('"
. secQuotes($_POST['title'])
."', '"
. secQuotes($_POST['text'])
."')";

$connector->insert($query);

}

}

if(isset($_POST['getDbEntry'])){

$result = $connector->query("SELECT * FROM test");

while($row = $connector->fetchArray($result)){

echo 'ID: '.$row['id']."\n".'<br />';
echo 'Title: '.$row['title']."\n".'<br />';
echo 'Article: '.$row['text']."\n".'<br />';

}

}

?>

Again, I might be wrong on this, feel free to elaborate.

Regards

ndlarsen
Reply With Quote