Which is the better code to use?
 

Can anyone pleases tell me which one of theses pieces of code is actually better to use in the register.php?

$getuser=$DB_site->query_first("SELECT username FROM user WHERE username='".addslashes($username)."'");

or

$getuser=$DB_site->query_first("SELECT username FROM user WHERE username='".addslashes(htmlspecialchars($username) )."'");

the second one i believe :)

If usernames are already htmlspecialchar'ed in the database, then the second one.

Ok, how would I find out if they are?

Register at your own forums using a username with a > in it, and then run these query:
[sql]
SELECT username FROM user WHERE username LIKE "%>%";
SELECT username FROM user WHERE username LIKE "%>%";
[/sql]

edit: of course vB is parsing the entities...

Here's the db error I got that is the basis for this question.

Database error in vBulletin 2.2.9:

Invalid SQL: SELECT username FROM user WHERE username='Julie'34'
mysql error: You have an error in your SQL syntax near '34'' at line 1

mysql error number: 1064

Date: Monday 28th of April 2003 02:03:42 PM
Script: http://www.bearfacts2.com/forum/forum/register.php
Referer: http://www.bearfacts2.com/forum/regi...p?action=check