Is mysql_real_escape_string() broken?

by

From the MySQL’s C API function mysql_real_escape_string description:

If you need to change the character set of the connection, you should use the mysql_set_character_set() function rather than executing a SET NAMES (or SET CHARACTER SET) statement. mysql_set_character_set() works like SET NAMES but also affects the character set used by mysql_real_escape_string(), which SET NAMES does not.

So don’t use SET NAMES/SET CHARACTER SET but PHP’s mysql_set_charset to change the encoding as that is the counterpart to MySQL’s mysql_set_character_set (see source code of /ext/mysql/php_mysql.c).

More Related Contents:

  1. Why is using a mysql prepared statement more secure than using the common escape functions?
  2. How can I prevent SQL injection in PHP?
  3. SQL injection that gets around mysql_real_escape_string()
  4. Is “mysqli_real_escape_string” enough to avoid SQL injection or other SQL attacks?
  5. PHP – Using PDO with IN clause array
  6. Reference: What is a perfect code sample using the MySQL extension? [closed]
  7. How to use mysqli prepared statements?
  8. MySQLi prepared statements error reporting [duplicate]
  9. Example of how to use bind_result vs get_result
  10. MySQL Prepared statements with a variable size variable list
  11. LIMIT keyword on MySQL with prepared statement [duplicate]
  12. mysqli: can it prepare multiple queries in one statement?
  13. SQL injections in ADOdb and general website security
  14. Escaping MySQL wild cards
  15. Escaping single quote in PHP when inserting into MySQL [duplicate]
  16. mysqli_stmt::bind_param(): Number of elements in type definition string doesn’t match number of bind variables
  17. How to search for slash (\) in MySQL? and why escaping (\) not required for where (=) but for Like is required?
  18. pdo prepared statements with wildcards
  19. Do I have to guard against SQL injection if I used a dropdown?
  20. How can I Use Prepared Statements in CodeIgniter
  21. Insert multiple rows with PDO prepared statements
  22. MySQL Prepared Statements
  23. PDOstatement (MySQL): inserting value 0 into a bit(1) field results in 1 written in table
  24. using nulls in a mysqli prepared statement
  25. Is mysql_real_escape_string() necessary when using prepared statements?
  26. PDO error: SQLSTATE[HY000]: General error: 2031
  27. How to prepare statement for update query? [duplicate]
  28. Use of PDO in classes [duplicate]
  29. Using Prepared Statement, how I return the id of the inserted row?
  30. Do I have to use mysql_real_escape_string if I bind parameters?

Leave a Comment