Question

Maybe I’m wrong but for me its not working,

I’m trying to do the mysql_real_escape_string() function with $_POST['value']; like this,

mysql_real_escape_string($_POST['value']);

but its not working, but if I try this,

$value = $_POST['value'];
mysql_real_escape_string($value);

it works perfectly, any suggestion why?

EDIT:

My code is like this,

$post = array('id', 'name');
$postArray = array();
foreach($post as $pa){
    $postArray[$pa] = mysql_real_escape_string($_POST[$pa]);
}

Answer 1

Are you assigning the result of mysql_real_escape_string() to anything? It doesn’t modify the variable in-place.

$value = mysql_real_escape_string($_POST['value']);

---

To respond to your edit – shouldn’t your foreach be looping over $post, not $postArray?

foreach($postArray as $pa){

should be…

foreach($post as $pa){

---

Second edit: please use this code and tell us what it outputs:

var_dump($_POST);
$post = array('id', 'name');
$postArray = array();
foreach($post as $pa){
    $postArray[$pa] = mysql_real_escape_string($_POST[$pa]);
}
var_dump($postArray);

---

Final edit:

Okay, your problem is that your incoming post variables are being read as arrays, and thus you can’t call mysql_real_escape_string() directly on those (because it’s designed for strings, not arrays).

Change your code to this:

$post = array('id', 'name');
$postArray = array();
foreach($post as $pa){
    if(is_array($_POST[$pa])) {
        $postArray[$pa] = mysql_real_escape_string($_POST[$pa][0]);
    } else {
        $postArray[$pa] = mysql_real_escape_string($_POST[$pa]);
    }
}

and things should work.