Question

I can’t use mysql_real_escape_string since we are not using mysql (but drizzle instead), so I made a custom escape function. Please tell me if this is fine or not

function escape($value)
{
  $return = '';
  for ($i = 0; $i < strlen($value); ++$i) {
    $char = $value[$i];
    $ord = ord($char);
    if ($char !== "'" && $char !== "\"" && $char !== '\\' && $ord >= 32 && $ord <= 126)
      $return .= $char;
    else
      $return .= '\\x' . dechex($ord);
  }

  return $return;
}

i will be primarily using this for $value’s in several SQL’s

Answer 1

I suspect you should be using drizzle_escape_string

the drizzle-php thing does not has its own escape function

Zend seems to say that it does (quite a long way down the page).