sql injection

[ayushchd]

Is it enough to use mysql_escape_string to safeguard from sql injection attacks?

[ayushchd]

Thanks.

Can you tell me what's wrong with the function I posted in my previous reply?

[henry0]

What seems to be the problem

run my test it works, escape ok and does not return any error

<?

function db_connect()
{
$result = @mysql_pconnect("aaaa", "bbbb", "sssss");
if (!isset($result) && empty($result))
{echo "can't connect!"; }
if (!@mysql_select_db("#*$!xx"))
return false;
return $result;
}

$conn=db_connect();

function SqlClean($my_var)
{
if (get_magic_quotes_gpc())
{
if (is_array($my_var)) {
foreach ($my_var as $key) {
stripslashes($key);
}
} else {
stripslashes($my_var);
}
}
if (is_array($my_var)) {
foreach ($my_var as $key) {
$key = mysql_real_escape_string($key);
return $key;
}
} else {
$my_var = mysql_real_escape_string($my_var);
}
return $my_var;
}

$a=" 'asass' ";
$a=SqlClean($a);
echo" test: $a";
?>