3 ms·
I use this to clean all my strings: private function clean_string($string, $strip_tags = true) { if (!strlen($string)) return NULL; if (get_magic_q
by agotterer 18y ago
I use this to clean all my strings:
private function clean_string($string, $strip_tags = true) {
if (!strlen($string)) return NULL;
if (get_magic_quotes_gpc()) $string = stripslashes($string);
if($strip_tags)
$string = strip_tags($string);
if (!is_numeric($string)) {
$string = mysql_escape_string($string);
}
return $string;
}
Edit: You only need to use mysql_real_escape_string if you are inserting binary data or need to use database character sets. mysql_real_escape_string also requires a mysql connection and link identifier.
- invisible 18y agoprivate function clean_string($string, $strip_tags = true,$empty_null = true) { if (!strlen($string) and $empty_null) return NULL; if($strip_tags) $string = strip_tags($string); return get_magic_quotes_gpc() ? mysql_escape_string(stripslashes($string)) : mysql_escape_string($string); } This is most likely faster because you're not changing the memory so frequently. In this is_numeric isn't needed because it'd just slow things down. It's really good practice to use mysql_real_escape_string, but I respect this way for simplicity's sake.