Posted by Richard Lynch on 05/13/05 01:52

On Thu, May 12, 2005 12:39 pm, James Williams said:
> I'm pretty sure that, in order to use mysql_real_escape_string() you
> must have magic quotes off or use stripslashes first... the same as
> addslashes, so it should work if you just search and replace. Don't
> quote me on that though

Well, yes, but you see it's no longer as simple as a global search and
replace, since there is no addslashes all over the place.

I have to hand-examine every file in, what, almost a decade's worth of
code spread over several dozen websites?

What is the CURRENT security advantage, if any, to
mysql_real_escape_string versus Magic Quotes?

--
Like Music?
http://l-i-e.com/artists.htm

[Back to original message]