Home/ Questions/Q 5980229
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-22T21:46:17+00:00

I’m learning how to sanitize my forms and know that using the PHP function

  • 0

I’m learning how to sanitize my forms and know that using the PHP function mysql_real_escape_string() helps escape characters that are consider “dangerous” or will break the syntax of your SQL. I was testing it out and noticed that it doesn’t escape character sequences such as -- or /* */. Aren’t these comments in SQL and couldn’t they break the syntax of a statement? How would you hand these and other items that mysql_real_escape_string() does not cover and really sanitize your forms?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    They will never break a SQL statement as they will never break out of a string, and therefore your string remains intact, protecting you from any nasty injections.

    That does not mean you don’t want to remove them from the string however. From a MySQL point of view they are safe, but depending on your application that may not be the case.

    • 0