Question

I am writing a little PHP-MySQL interface — However, when I try to escape strings using mysql_real_escape, they are getting wiped blank!

Let’s say we have a PHP file at the url

http://web/file.php

The contents of this file are:

echo $_GET["action"];
echo  mysql_real_escape_string($_GET["action"]);

Now, let’s say we load the url:

http://web/file.php?action=asdfqwerty

The FIRST echo will output “asdfqwerty”.

However, the second one outputs nothing at all! I’m not sure why this is… Can anyone help out? Thankyou!

Answer 1

As documented here, mysql_real_escape_string needs an open database connection. If none exists, an error occurs. You seem to have your PHP configured to not output errors, so you can’t see this. You can verify it by using a higher error level:

<?php
error_reporting(E_ALL);
echo $_GET["action"];
echo  mysql_real_escape_string($_GET["action"]);

Or by adapting your php.ini.