dustinnoe Posted March 26, 2007 Share Posted March 26, 2007 addslashes() VS. mysql_real_escape_string() mysql_real_escape_string() does more in the way of escaping special characters but runs about three times slower than addslashes() I timed script execution and these are my results(in microseconds): mysql_real_escape_string(): 7.3E-005 addslashes(): 2.4E-005 What's better? Should I go for the speed of addslashes() or the completeness of mysql_real_escape_string()? Link to comment https://forums.phpfreaks.com/topic/44321-solved-whats-better/ Share on other sites More sharing options...
r-it Posted March 26, 2007 Share Posted March 26, 2007 id say use mysql_real_escape_string as addslashes is still vulnerable to sql injection attacks Link to comment https://forums.phpfreaks.com/topic/44321-solved-whats-better/#findComment-215242 Share on other sites More sharing options...
Orio Posted March 26, 2007 Share Posted March 26, 2007 Yep, r-it is right. When it comes to security, don't compromise. Orio. Link to comment https://forums.phpfreaks.com/topic/44321-solved-whats-better/#findComment-215249 Share on other sites More sharing options...
dustinnoe Posted March 26, 2007 Author Share Posted March 26, 2007 What is funny is that I had never even heard about mysql_real_escape_string() until browsing the manual. Every tutorial I have ever read has used addslashes(). As far as I can tell though addslashes() will do enough to stop SQL injection. Can you think of any examples where mysql_real_escape_string() is nessesary over addslashes()? Link to comment https://forums.phpfreaks.com/topic/44321-solved-whats-better/#findComment-215254 Share on other sites More sharing options...
Orio Posted March 26, 2007 Share Posted March 26, 2007 http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string Orio. Link to comment https://forums.phpfreaks.com/topic/44321-solved-whats-better/#findComment-215255 Share on other sites More sharing options...
dustinnoe Posted March 26, 2007 Author Share Posted March 26, 2007 http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string Orio. I'm convinced! Link to comment https://forums.phpfreaks.com/topic/44321-solved-whats-better/#findComment-215259 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.