Ask YC: Those using PHP, what do you use for talking to your database (MySQL)?

Re:Ask YC: Those using PHP, what do you use for talking to y... by agotterer on Monday August 11, 2008 @02:16PM (#273183)

I use this to clean all my strings:

private function clean_string($string, $strip_tags = true) {

     if (!strlen($string)) return NULL;

     if (get_magic_quotes_gpc()) $string = stripslashes($string);
		
     if($strip_tags)
	$string = strip_tags($string);
		
     if (!is_numeric($string)) {
         $string = mysql_escape_string($string);
     }
		
     return $string;

}

Edit: You only need to use mysql_real_escape_string if you are inserting binary data or need to use database character sets. mysql_real_escape_string also requires a mysql connection and link identifier.

[ Parent | on HN ]

Re:Ask YC: Those using PHP, what do you use for talking to y... by invisible on Monday August 11, 2008 @03:37PM (#273256)

  private function clean_string($string, $strip_tags = true,$empty_null = true) {
    if (!strlen($string) and $empty_null) return NULL;
    if($strip_tags)
      $string = strip_tags($string);
  
    return get_magic_quotes_gpc() ? mysql_escape_string(stripslashes($string)) : mysql_escape_string($string);
  }

This is most likely faster because you're not changing the memory so frequently. In this is_numeric isn't needed because it'd just slow things down. It's really good practice to use mysql_real_escape_string, but I respect this way for simplicity's sake.

[ Parent | on HN ]