|
Posted by Michael Fesser on 11/15/06 18:52
..oO(Steve)
>"Christoph Burschka" <christoph.burschka@rwth-aachen.de> wrote in message
>news:4rtdltFsphjiU1@mid.dfncis.de...
>
>sure, if you want to piss off or otherwise confuse users...by all means,
>make assumptions about what they want to store! the correct answer here is
>to ENCAPSULATE single quotes, NOT to remove them outright!!!
ACK
That's what mysql_real_escape_string() is for.
Of course even better would be to use the PDO extension (if available)
and prepared statements.
Micha
Navigation:
[Reply to this message]
|