mysql_real_escape_string HELP!!

[eynesilli]

not always but depends on how your mysql query's are scripted
mysql_real_escape_string() backslashes things such as ' and " however an injection can be as simple as:

OR 1 

(no quotes ^ )



use:
[php]
$message = mysql_real_escape_string($message);

Thanks, but still did not understand anything

[metulj]

Hey friends, i will like to know if i parse all data thru
mysql_real_escape_string
then will it protect my site from sql injection?? and its dark-sides?? any harm using it??
likewise this for all get , post, server etc

$msg = mysql_real_escape_string( $_GET['msg'] );

please leave your valuable comments @ all

mysql_real_escape_string() will not be enough brother.

i dont see why that wouldnt be enough...?? you mind to explain ?

other than that... i do prefer this

$msg = mysql_real_escape_string(strip_tags(htmlspecialchars($_GET['msg']))); 

just to ''sleep better''

[analyzer]

mysql_real_escape_string() will not be enough brother.

[something else]

Hey friends, i will like to know if i parse all data thru

mysql_real_escape_string

then will it protect my site from sql injection?? and its dark-sides?? any harm using it??

likewise this for all get , post, server etc

$msg = mysql_real_escape_string( $_GET['msg'] );

please leave your valuable comments @ all

not always but depends on how your mysql query's are scripted
mysql_real_escape_string() backslashes things such as ' and " however an injection can be as simple as:

OR 1 

(no quotes ^ )

if($message!=""){
if(isspam($message))$spam=" reported='1',";
else $spam="";
$res=mysql_query("INSERT INTO inbox SET text='".$message."', byid='".getuid_sid($sid)."', toid='".$who."',$spam timesent='".time()."'");

use:
[php]
$message = mysql_real_escape_string($message);

[wap-ruler]

rep

if($message!=""){
if(isspam($message))$spam=" reported='1',";
else $spam="";
$res=mysql_query("INSERT INTO inbox SET text='".$message."', byid='".getuid_sid($sid)."', toid='".$who."',$spam timesent='".time()."'");

What do u mean by how to plz describe.

[eynesilli]

how-to here?

if($message!=""){
if(isspam($message))$spam=" reported='1',";
else $spam="";
$res=mysql_query("INSERT INTO inbox SET text='".$message."', byid='".getuid_sid($sid)."', toid='".$who."',$spam timesent='".time()."'"); 

[icedroplet1987]

thnx sir

[GumSlone]

yes it will

[icedroplet1987]

Hey friends, i will like to know if i parse all data thru

mysql_real_escape_string

then will it protect my site from sql injection?? and its dark-sides?? any harm using it??

likewise this for all get , post, server etc

$msg = mysql_real_escape_string( $_GET['msg'] );

please leave your valuable comments @ all