3 ms·
This is provided by MySQL, as an example: http://dev.mysql.com/doc/refman/5.0/en/mysql-real-escape-string.html http://dev.mysql.com/doc/refman/5.0/en/mysql-rea
by spullara 15y ago
This is provided by MySQL, as an example:
http://dev.mysql.com/doc/refman/5.0/en/mysql-real-escape-string.html http://dev.mysql.com/doc/refman/5.0/en/mysql-real-escape-str...
I'm sure what you meant was a server-side escaping function which is obviously pointless, but I did want to point out that MySQL's client driver does ship with one that you can use so you don't have to write your own.
- gizzlon 15y agoActually, isn't the escaping done serversiden when using placeholders? At least in Perl, there's no need to escape placeholder values explicitly. I believe the prepared statement is stored on the server, and then the values sent later. Of course the escaping could be the work of the driver.. anyone know?
- rjh29 15y agoSee "Prepared Statement Support" from http://search.cpan.org/perldoc?DBD::mysql#Class_Methods http://search.cpan.org/perldoc?DBD::mysql#Class_Methods Prepared statements are disabled by default and require MySQL >= 4.1.3. Instead, the driver does the placeholder replacement on the client, and prepare() does nothing clever at all.
- gizzlon 15y agohm.. could be useful information.. thanks
- gmaslov 15y agoWell, just because it really exists doesn't mean it wasn't a silly thing to ask for ;-)
- flomo 15y agoBuilding dynamic SQL strings for comparison can sometimes be handy (e.g. with LIKE), so it's really too bad there's no server-side SQL escape function, at least in the sql dialects I'm familiar with.