En dan ga je juist slashes toevoegen?
MYSQL/PHP probleem
Aarclay schreef:mysql_real_escape_string is het escapen van syntax-gevoelige karakters die SQL-Querys kunnen manipuleren. Addslashes doet dit ook.En dan ga je juist slashes toevoegen?
Echter heb je wel gelijk dat addslashes niet echt is aan te raden, beter gebruikt met mysql_real_escape_string. Maar mits die mysql_ wegvalt in PHP 5.5 wou ik die niet gebruiken. Ik ben ook niet vertrouwd met mysqli, maar meer met PDO.
Ik ga ervan uit dat de TS niet vertrouwd is met PDO, dus heb ik addslashes gebruikt. Opzich niet zo erg want ik denk niet dat er hier velen in staat zijn om addslashes te omzeilen.
En dan is het alsnog onverstandig om addslashes() te gebruiken:
Quote:
Difference #1
addslashes does not know anything about MySql connection encodings. If you pass it a string containing bytes representing an encoding other than the encoding used by the MySql connection, it will happily escape all bytes having the values of the characters , ", and x00. This may not be the same as all the characters , ", and x00 if you are using an encoding other than 8-bit encodings and UTF-8. The result will be that the string received by MySql will be corrupted.
To trigger this bug, try using iconv to convert your variable to UTF-16 and then escape it with addslashes. See what your database receives.
This is one reason why addslashes should not be used for escaping.
Difference #2
In contrast to addslashes, mysql_real_escape_string also escapes the characters r, n, and x1a. It appears that these characters have to be escaped as well when talking to MySql, otherwise a malformed query may be the result
This is the other reason why addslashes should not be used for escaping.
Bron: http://stackoverflow.com/questions/4486016/whats-the-difference-between-phps-addslashes-and-mysqli-escape-string
Adviseer dan gewoon mysqli_real_escape_string().
Quote:
Difference #1
addslashes does not know anything about MySql connection encodings. If you pass it a string containing bytes representing an encoding other than the encoding used by the MySql connection, it will happily escape all bytes having the values of the characters , ", and x00. This may not be the same as all the characters , ", and x00 if you are using an encoding other than 8-bit encodings and UTF-8. The result will be that the string received by MySql will be corrupted.
To trigger this bug, try using iconv to convert your variable to UTF-16 and then escape it with addslashes. See what your database receives.
This is one reason why addslashes should not be used for escaping.
Difference #2
In contrast to addslashes, mysql_real_escape_string also escapes the characters r, n, and x1a. It appears that these characters have to be escaped as well when talking to MySql, otherwise a malformed query may be the result
This is the other reason why addslashes should not be used for escaping.
Bron: http://stackoverflow.com/questions/4486016/whats-the-difference-between-phps-addslashes-and-mysqli-escape-string
Adviseer dan gewoon mysqli_real_escape_string().