Which is the better code to use?

[Boofo]

Can anyone pleases tell me which one of theses pieces of code is actually better to use in the register.php?

$getuser=$DB_site->query_first("SELECT username FROM user WHERE username='".addslashes($username)."'");

or

$getuser=$DB_site->query_first("SELECT username FROM user WHERE username='".addslashes(htmlspecialchars($username))."'");

[DigitalDesktops]

the second one i believe :)

[filburt1]

If usernames are already htmlspecialchar'ed in the database, then the second one.

[Boofo]

Today at 05:32 PM filburt1 said this in Post #3 (https://vborg.vbsupport.ru/showthread.php?postid=388625#post388625)
If usernames are already htmlspecialchar'ed in the database, then the second one.

Ok, how would I find out if they are?

[filburt1]

Register at your own forums using a username with a > in it, and then run these query:

SELECT username FROM user WHERE username LIKE "%>%";
SELECT username FROM user WHERE username LIKE "%>%";


edit: of course vB is parsing the entities...

[Boofo]

Here's the db error I got that is the basis for this question.

Database error in vBulletin 2.2.9:

Invalid SQL: SELECT username FROM user WHERE username='Julie'34'
mysql error: You have an error in your SQL syntax near '34'' at line 1

mysql error number: 1064

Date: Monday 28th of April 2003 02:03:42 PM
Script: http://www.bearfacts2.com/forum/forum/register.php
Referer: http://www.bearfacts2.com/forum/register.php?action=check