I get this error when I run mysql_real_escape_string($value).
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Can't connect to MySQL server on 'localhost' (10061) in ...
I wrapped up the functionality in a nice class like this
class escaper
{
function __get($value)
{
//in order for this to work properly, I must have a live connection to mysql
return mysql_real_escape_string($value);
}
}
/*
//sample usage
$safe = new escaper;
$name = "O'Reilly";
echo $safe->$name
In case someone goes down that road again, let me say it upfront that Yes! I should use PDO and parametrized queries and that the above method is not that safe.
how do you programmatically tell whether a mysql connection is present?
we just don't need that.
connection is always present
Escaping being a part of the DB class.
Connect to the database is the very first thing this class doing in the constructor.
And connect resource stored in the class variable.
So, only we need is to use this variable - easy-peasy.
mycol1
,mycol2
from mytable
. Can the ticks in any shape or form be of any help against sql injection? for example, if I make the as part of the escaper so all
s are escaped by `, would that give us any protection? ex: select {safe->$col1}
you know what I mean - Average Joe 2012-04-06 19:36