Security: SQL Insertion

[VBCoder]

Yeah, addslashes is not sufficient, for a lot of reasons.

I took a look at escape_string - it defaults to mysql_escape_string(), which is good, except:

Originally Posted by PHP Docs

This function became deprecated, do not use this function. Instead, use mysql_real_escape_string().

But at least we're somewhere...

It's a shame that PHP programmers have to go through such hoolahoops for what should be basic DB class functionality (again, see DBI for an example)... Building your own string is not only ineffecient, (and a hassle for the programmer) - it opens the door to a lot of security issues and internationalization bugs