Getting parameters from a query

[bobo01]

Hello,

 

I have made some dynamic code that performs a query on the SQL database, I only know that query at run time.

 

However, after reading some more about PHP, I noticed that I need to include the function mysql_real_escape_string before doing this line:

 

@mysql_query( $aStatement);

 

So, how can I read that $aStatement and then call the mysql_real_escape_string function for each needed parameter?

 

Thanks.

 

 

[MasterACE14]

You need to escape any data that goes into the $aStatement query, especially $_POST's and $_GET's

[aneeshrp]

You have to escape string when you assign the query to $aStatement.  Normally in php apps, the data part for the query will be taken from $_GET or $_POST.  It is always advised to escape string before executing it in DB. 

 

Alternatively you can make use of php's array map function at the start of your code to escape string.

 

$_GET = array_map('mysql_real_escape_string', $_GET);

$_POST = array_map('mysql_real_escape_string', $_POST);