mysql_real_esca pe_string wrapper problem!

[srbakshi]

Hey all,
I'm stuck with the following:

The mysql_real_esca pe_string(conn, to, from, strlen(from)) function does not return the escaped string. So how can I go about writing a wrapper for it so that it RETURNS the 'to' string which in turn helps me fill out a query in the following manner using sprintf:

unescaped_query = "INSERT into MYTABLE values ('%s', '%s')";
sprintf(escaped_query, unescaped_query, wrapper(<string argument no.1 that needs to be escaped>, wrapper(<string argument no.2 that needs to be escaped>);
/* Execute escaped_query */

You see the problem I'm running into is that the same "wrapper" function is going to be called more than once in a single sprintf statement. That is causing the return value to get overwritten after every call to "wrapper", leading to all values in the table being one and the same (as the return value of the last wrapper function call).

Can anybody help? :((
I'm sure this is a common problem and there must be a better and more established way of doing it. Just point me in the right direction.
Thanks in advance,
Sid :O)

[Atli]

@srbakshi
Where did you get that info from?
According to the manual, this function is described as:

string mysql_real_esca pe_string ( string $unescaped_stri ng [, resource $link_identifie r ] )

Also, the way you use sprintf makes no sense according to the manual.

Doing something like this should work fine:

$rawSQL = "INSERT into MYTABLE values ('%s', '%s')";
$formattedSQL = sprintf($rawSQL, 
                   mysql_real_escape_string($firstValue)
                   mysql_real_escape_string($secondValue));
// Execute the formatted SQL

[srbakshi]

@Atli
Right here: http://dev.mysql.com/doc/refman/5.1/...pe-string.html
Im working on Sun Solaris and the mysql_real_esca pe_string you talked about does not work.
So any suggestions now?
-Sid

[Atli]

Ahh ok.
As you didn't provide the language you were using, I assumed you were using PHP. (Usually a safe bet.)
Please try to include facts like these in your posts, so we are not forced to guess.

Unfortunately I've little experience with C, so I can't really help much.
I'll move this over to the C/C++ forum. Maybe the experts over there will be able to help.