May 2005
Intermediate to advanced
352 pages
14h 39m
English
mysql_escape_string( )
mysql_escape_string(string)This
returns the string given with special characters preceded by
backslashes so that they are protected from being interpreted by the
SQL interpreter. This function is used in conjunction with
mysql_query( ) to help make SQL statements safe.
It's similar to mysql_real_escape_string(
).
...
$clientid = '1000';
$description = "Can't connect to network.";
$description = mysql_escape_string($description);
$sql_stmnt = "INSERT INTO workreq
(date, clientid, description)
VALUES(NOW( ), '$clientid', '$description')";
mysql_query($sql_stmnt);
...The string contained in the $description variable
contains an apostrophe, which would cause the SQL statement to fail.
It will fail because the related value in the SQL statement is
surrounded by single quotes; an apostrophe would be mistaken for a
single quote, which has special meaning in MySQL.
Read now
Unlock full access