Question

In most cases whenan sql update query is posted my php script, it works without problem. However, in some cases I get an error from mysql. I’m using a encryption function to send data over the net, so it arrives as sent.

If I post the same query into phpmyadmin, it always works.

Do I need to add $sql = addslashes($sql); ?

I’m hesitant to use this on all queries as most of the work and I don’t want to end up with slashes in my data when it may not be needed.

Answer 1

mysql_real_escape_string

ex:

$c = mysql_connect("localhost","a","b");
$query = 'SELECT * FROM table WHERE name="%s";'
mysql_query(sprintf($query,mysql_real_escape_string($_POST['name'],$c)));