Why check for mysql_real_escape_string () returns

In every blog / article / Q & A that I read, no one suggested checking the value returned mysql_real_escape_string().

The way I see this, this check is very important to ensure data consistency, because if this function fails, the value inserted into the database will be false possible: the boolean type is FALSE-casted as string, resulting in an empty string, not what you expect.

According to the documentation:

Returns the escaped string, or FALSE on error. 

A MySQL connection is required before using mysql_real_escape_string() otherwise an error of level E_WARNING is generated, and FALSE is returned. If link_identifier isn't defined, the last MySQL connection is used. 

A warning is good if you go to the logs to find out what happened, but that wouldn't hurt.

I know that failure is very small, but if there is at least one change, this should be expected by your application.

This function does not work if:

  • the developer did not connect to the database before calling this function
  • .
  • ( mysql)
  • ...

:

$db = mysql_connect() or die('Cannot connect to database');
$value = mysql_real_escape_string($_POST['value'], $db);
mysql_query('insert into tablex (value) values ("'.$value.'")', $db) or die('Cannot insert data in database');

- ( am OO- mysql):

class mywrapper{
    // ... [code ...]

    // $this->db is the mysql link identifier
    public function escape($string)
    {
        if(mysql_real_escape_string($string, $this->db) === false)
        {
            throw new Exception('Some message');
        }
    }
} // end class    

    // I'm calling it as 
    // $myWrapper->insert('insert into tablex (value) values ("'.($myWrapper->escape($value)).'")');

, , , , , .

- ? , ?:)

+3
3

, , . ( )

, nothing mysql ( , nothing value $_POST).

0

- - , mysql_. mysqli PDO. , .

+2

, :

:

$db = mysql_connect();

, , . , "" ( ), (1).

If you lose the connection in the meantime, your request will not be executed, so it does not matter what you sent (2).

mysql_real_escape_string runs on the client side, so using mysql server memory is not a problem (3).

-1
source

All Articles