2 ms·
It did have serious security issues. That’s why not long after there was another function added named mysql_real_escape_string.
by bradleyjg 8y ago
It did have serious security issues. That’s why not long after there was another function added named mysql_real_escape_string.
- duskwuff 8y agoNo, that's not true. That function name was copied directly from the MySQL C API. It was not added by PHP. https://dev.mysql.com/doc/refman/5.5/en/mysql-real-escape-string.html https://dev.mysql.com/doc/refman/5.5/en/mysql-real-escape-st...
- bradleyjg 8y ago“You can use this function safely with your MySQL database queries if and only if you are sure that your database connection is using ASCII, UTF-8, or ISO-8859-* and that the backslash is your database's escape character. If you're not sure, then use mysqli_real_escape_string instead. This function is not safe to use on databases with multi-byte character sets.”
- buboard 8y agoyou're focusing on a function with a known limitation, that was superceded 15 years ago and practically everyone used mysql_real since then. That's not the reason why the module was removed though. The reason is that the mysql_* functions are "too low level for noobs". https://stackoverflow.com/questions/16859477/why-are-phps-mysql-functions-deprecated https://stackoverflow.com/questions/16859477/why-are-phps-my...