my_real_escape_string problem

[mun]

when magic_quotes_gpc = off, what is the difference between
addslashes($var) and my_real_escape_string($var).

I use a function from php manual like this:

function quote_smart($value)
{
// Stripslashes
if (get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
// Quote if not integer
if (!is_numeric($value)) {
$value = " ' " . mysql_real_escape_string($value) . " ' ";
}
return $value;
}
I use it with a select query like this: "select * from table where id
= ".quote_smart($_GET["id"]) and it doesn't work (no result returned).
But when I replace the quote_smart function with the normal addslashes
function, it works. (my default magic_quotes_gpc = off)

[Man-wai Chang]

function quote_smart($value)

{
// Stripslashes
if (get_magic_quotes_gpc()) {
$value = stripslashes($value);
But when I replace the quote_smart function with the normal addslashes
function, it works. (my default magic_quotes_gpc = off)

You talking about "add" or "strip"?

--
iTech Consulting Co., Ltd.
Expert of ePOS solutions
Website: http://www.itech.com.hk (IE only)
Tel: [phone] Fax: [phone]

[Jerry Stuckle]

mun wrote:

when magic_quotes_gpc = off, what is the difference between
addslashes($var) and my_real_escape_string($var).

I use a function from php manual like this:

function quote_smart($value)
{
// Stripslashes
if (get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
// Quote if not integer
if (!is_numeric($value)) {
$value = " ' " . mysql_real_escape_string($value) . " ' ";
}
return $value;
}
I use it with a select query like this: "select * from table where id
= ".quote_smart($_GET["id"]) and it doesn't work (no result returned).
But when I replace the quote_smart function with the normal addslashes
function, it works. (my default magic_quotes_gpc = off)

RTFM. mysql_real_escape_string() is charset sensitive. addslashes() is not.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Toby A Inkster]

mun wrote:

function quote_smart($value)
{
// Stripslashes
if (get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
// Quote if not integer
if (!is_numeric($value)) {
$value = " ' " . mysql_real_escape_string($value) . " ' ";
}
return $value;
}

Code defensively...

function quote_smart ($value)
{
if (is_numeric($value))
return $value;

if (get_magic_quotes_gpc())
$value = stripslashes($value);

if (function_exists('mysql_real_escape_string'))
return mysql_real_escape_string($value);

trigger_error("mysql_real_escape_string function does not exist!");
return addslashes($value);
}

Does that work OK? Try it a few times. Now check your PHP error log and
see if a surprise message awaits!

--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~ http://tobyinkster.co.uk/contact
Geek of ~ HTML/SQL/Perl/PHP/Python*/Apache/Linux

* = I'm getting there!

[mun]

On Mar 19, 6:04 am, Toby A Inkster <[e-mail]>
wrote:

mun wrote:

function quote_smart($value)
{
// Stripslashes
if (get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
// Quote if not integer
if (!is_numeric($value)) {
$value = " ' " . mysql_real_escape_string($value) . " ' ";
}
return $value;
}

Code defensively...

function quote_smart ($value)
{
if (is_numeric($value))
return $value;

if (get_magic_quotes_gpc())
$value = stripslashes($value);

if (function_exists('mysql_real_escape_string'))
return mysql_real_escape_string($value);

trigger_error("mysql_real_escape_string function does not exist!");
return addslashes($value);

}

Does that work OK? Try it a few times. Now check your PHP error log and
see if a surprise message awaits!

--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~http://tobyinkster.co.uk/contact
Geek of ~ HTML/SQL/Perl/PHP/Python*/Apache/Linux

* = I'm getting there!

I am sorry for my late reply. I will try the function and let you know.