Escape user input

[ryy705]

Hello,

 

What is the proper way to escape user input before using it as a part of a query?

I've  always used mysql real escape with mysql.  But don't see anything like that for mssql.

 

The following is what plan on using. Is it sufficient?

 

$input = str_replace("'", "''", $input);
mssql_query (sprintf ("UPDATE Login SET user = '%s'", $input));

 

Any input would be helpful.

 

[Adam]

This is a pretty tight filtering method, superior to mysql_real_escape_string() ...

 

addcslashes($str, "\x00\n\r\'\x1a\x3c\x3e\x25");

[corbin]

This is a pretty tight filtering method, superior to mysql_real_escape_string() ...

 

addcslashes($str, "\x00\n\r\'\x1a\x3c\x3e\x25");

 

 

MSSQL does not use \ as the escape character.  It uses '.

[darkgr33n]

 

The following is what plan on using. Is it sufficient?

 

$input = str_replace("'", "''", $input);
mssql_query (sprintf ("UPDATE Login SET user = '%s'", $input));

 

Any input would be helpful.

 

 

That's what I've done and it seems to work

. I did a fair amount of research, and read a couple of times that this was the preferred method.