mysql_real_escape_string() problem

[robert_gsfame]

how can i use mysql_real_escape_string() when i have the following query

SELECT * FROM $table WHERE $search LIKE '%$data%' AND user_id='$userid'

 

thx in advance

[Andy-H]

$query = "SELECT * FROM " . $table . " WHERE " . mysql_real_escape_string($search) . " LIKE '%" . mysql_real_escape_string($data) . "%' AND user_id=" . (int)$userid;

 

Assuming a valid mysql connection has been previously establised, $table is safe (hardcoded) data supplied by yourself and userid is an integer.

[robert_gsfame]

thx andy-H!!

[Andy-H]

No problem