mysql_escape_string

jpr

Does anyone know of a better way to manage input and output. I have an application, a client can input text, which is then stored in a database. The text is later pulled out and displayed on a page or sent in an email. I run into the problem of keeping my database information secure, however mysql_escape_string() adds extra characters like "\n\n\t". I want to stay secure, but I also want to maintain the format of the data. Any thoughts?

Jason

bodzan

...you might want to convert to mysql_real_escape_string() since mysql_escape_string() is deprecated according to the PHP manual...

Also you might be aware of this and might not but the data that is inserted with \n's and \r's in database is still the same looking when outputed to HTML...

jpr

Not always, its different on differnt hosts. It all depends how the host is set up to pull information out of the database. Sometimes it is displayed normally, othertimes not. It is unpredictable.

Jason

bodzan

...nl2br() to keep the appearance instead... It will output the same structure because it will replace all \n's with <br /> tag...

Anyways I said a false thing: in HTML all spaces are counted as one except when the space is asked for with the & nbsp;... \n's and \r's will make the difference only in plain text emails...

What I meant is: the data is going to keep the structure user intendended for it with \n's instead of every Enter hit. nl2br() will keep that order of business in keeping it look the same by converting it to the same looking HTML output...

Sorry for that...

jpr

But what if we throw this into the mix. The applciation allows a choice, use a standard textbox interface, or use an enhanced htmlarea style textbox. So now the data already has its own structure, when applying mysql_escape_real_string(), the data will receive the new additional formatting characters (\n\n\t), and we cant do the nl2br() because that would add extra line breaks. So I guess what I'm looking for is a I need a safe way other than mysql_escape_string()/mysql_escape_real_string() that does not affect the data structure.

Jason