Do I need to use mysql_real_escape_string in SELECT queries?

[php_guest]

I am wondering if I need to use mysql_real_escape_string in SELECT sentences or is this needed only in INSERT and UPDATE sentences? Do I need to be carefull in search form where only select sentences are used?

[fenway]

Always.

[Mchl]

Suppose you have a query to check for user login

<?php
$query = "SELECT ID FROM users WHERE username = '{$_POST['username']}' AND password = MD5('{$_POST['password']}')";
$result = mysql_query[$query];
if(mysql_num_rows($result) > 0) {
  //do login stuff
  echo "You're now logged in";
} else {
  echo "Login incorrect, try again.";
}

 

Now let's say I use the login form to send a username like this:

foo' OR 1; --

 

So the query sent to database will look like this:

SELECT ID FROM users WHERE username = 'foo' OR 1;--' AND password = MD5('') 

 

(-- starts a comment in MySQL, just like // starts comment in PHP - everything after -- is ignored by database)

This will in turn return all rows from users table, so mysql_num_rows() will return a number larger than 0 and the login will be successful