Posted by Michael Fesser on 11/15/06 18:52

..oO(Steve)

>"Christoph Burschka" <christoph.burschka@rwth-aachen.de> wrote in message
>news:4rtdltFsphjiU1@mid.dfncis.de...
>
>sure, if you want to piss off or otherwise confuse users...by all means,
>make assumptions about what they want to store! the correct answer here is
>to ENCAPSULATE single quotes, NOT to remove them outright!!!

ACK

That's what mysql_real_escape_string() is for.

Of course even better would be to use the PDO extension (if available)
and prepared statements.

Micha

[Back to original message]