mysql and escape character and injections

[Pico_Train]

Hi There!

Say I have a form that posts data for insertion to a DB and the one post is $_POST['name'].

So I go and type my name as example's in the form and click submit.

When I echo the MySQL statement it gets inserted example\'s

Does this mean it is MySQL injection safe or do I need to do more?

Thanks!

[edited by: Pico_Train at 1:18 pm (utc) on May 20, 2008]

[wheelie34]

From what I understand mysql adds slashes before inserting, I don't think it has anything to do with avoiding injections, try keeping your insert pages behind .htaccess area or a secure login area, that way only you or the user can add data

[rocknbil]

A Wiki that might be helpful [en.wikipedia.org].