Home/ Questions/Q 7491849
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-29T16:11:07+00:00

Been developing an application using PHP’s PEAR framework, but ran into an issue where

  • 0

Been developing an application using PHP’s PEAR framework, but ran into an issue where I am double-escaping/quoting input and it wasn’t letting newlines (\n) show up properly. Searching forums came up with a mix of answers, but was wondering if anyone has advice for whether using PEAR’s escape() or quote() functions is enough for SQL injection security, or should I stick with using mysql_real_escape_string()? I’m trying to use nl2br() + htmlspecialchars() to spit out the content afterwards, and originally incorrectly used the following to escape input:

$db->quote(mysql_real_escape_string(trim($_POST['text'])));

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Use the escaping function of your database driver. If you’re using a PEAR package to connect to the database, use its escaping function. If you’re using the raw mysql functions, use mysql_real_escape_string. Don’t use more than one (as you have figured out).

    Better yet, go with the times and use modern prepared statements, for example PHP’s PDO class.

    • 0