Posted by Toby A Inkster on 08/05/07 07:45

NC wrote:

> $sql = 'INSERT INTO comments (comment, name, quotekey) ' .
> "VALUES ('$comment', '$name', '$key')";
> mysql_real_escape_string($sql);

?? You should not be escaping the entire SQL query like this!

--
Toby A Inkster BSc (Hons) ARCS
[Geek of HTML/SQL/Perl/PHP/Python/Apache/Linux]
[OS: Linux 2.6.12-12mdksmp, up 45 days, 11:24.]

Command Line Interfaces, Again
http://tobyinkster.co.uk/blog/2007/08/02/command-line-again/

[Back to original message]