mysql real escape string returning nothing

[asantos]

Hi,
im using this function to clean any potential SQL injection attacks:

function q($data,$string=false) {
if(get_magic_quotes_gpc()) {
$data = stripslashes($data);
}
$data = mysql_real_escape_string($data);
if($string) { $data = "'".$data."'"; }
return $data;
}

It did work on my local environment, but once uploaded to the server, this line returned nothing to the $data varriable:

$data = mysql_real_escape_string($data);

What could be wrong?

[starefossen]

Are you sure $data holds any value?

Could you test this for me on your server:

echo mysql_real_escape_string("test");

It should return and echo out test and we will know if the function is working right on your server. Try with other values other then test which you have parsed to your $data variable.

[asantos]

Actually yes, $data holds a value.

I tried this:
echo mysql_escape_string("test");
outputs: test

echo mysql_real_escape_string("test");
outputs:

I believe mysql_escape_string is almost the same as the other, with the only difference that the "real" one optionally receives a mysql resource as a parameter.

still strange...

[idfer]

Is it possible that you haven't connected to a mysql DB before making this call? From the manpage:

Note: A MySQL connection is required before using mysql_real_escape_string() otherwise an error of level E_WARNING is generated, and FALSE is returned. If link_identifier isn't defined, the last MySQL connection is used.

Make sure you have error reporting on up to warnings:

error_reporting(E_ALL ^ E_NOTICE);

And maybe test the returned value against false, which would indicate an error:

$escaped_string = mysql_real_escape_string("test");
if($escaped_string === false) echo 'oops!';

[henry0]

set by the top of your script
phpinfo();
run the script and find the line about magic quotes.
I bet your server environment has still
magic quotes on
if not then try removing the first part of your function
related to magic quotes
and run it again