diff --git a/reference/mysql/functions/mysql-real-escape-string.xml b/reference/mysql/functions/mysql-real-escape-string.xml index a1288a161b..30ae9fe87a 100644 --- a/reference/mysql/functions/mysql-real-escape-string.xml +++ b/reference/mysql/functions/mysql-real-escape-string.xml @@ -1,5 +1,5 @@ - + @@ -37,18 +37,37 @@ you must use this function. - mysql_real_escape_string calls MySQL's library function of the - same name, which prepends slashes to the following characters: + mysql_real_escape_string calls MySQL's library function (mysql_escape_string), + which prepends slashes to the following characters: NULL, \x00, \n, \r, \, ', " and \x1a. + + + Simple <function>mysql_real_escape_string</function> example + + +]]> + + + You must always (with few exceptions) use this function to make your data safe before inserting. If you have magic_quotes_gpc enabled, you must first stripslashes your data. If you don't use - this, you'll leave yourself open to SQL Injection Attacks. Here's an example: + this, you leave yourself open to SQL Injection Attacks. Here's an example: @@ -74,7 +93,7 @@ echo $query; @@ -85,18 +104,6 @@ SELECT * FROM users WHERE name='fred' AND password='' OR 1=1 - Our query is now safe no matter what the user submits! + The query will now execute correctly, and Injection attacks will no longer work. mysql_real_escape_string does not escape - % and _. These are wildcards in MySQL - if not bounded by quotes. + % and _. These are wildcards in MySQL if + combined with LIKE.