In every blog / article / Q & A that I read, no one suggested checking the value returned mysql_real_escape_string().
The way I see this, this check is very important to ensure data consistency, because if this function fails, the value inserted into the database will be false possible: the boolean type is FALSE-casted as string, resulting in an empty string, not what you expect.
According to the documentation:
Returns the escaped string, or FALSE on error.
A MySQL connection is required before using mysql_real_escape_string() otherwise an error of level E_WARNING is generated, and FALSE is returned. If link_identifier isn't defined, the last MySQL connection is used.
A warning is good if you go to the logs to find out what happened, but that wouldn't hurt.
I know that failure is very small, but if there is at least one change, this should be expected by your application.
This function does not work if:
- the developer did not connect to the database before calling this function
- .
- ( mysql)
- ...
:
$db = mysql_connect() or die('Cannot connect to database');
$value = mysql_real_escape_string($_POST['value'], $db);
mysql_query('insert into tablex (value) values ("'.$value.'")', $db) or die('Cannot insert data in database');
- ( am OO- mysql):
class mywrapper{
public function escape($string)
{
if(mysql_real_escape_string($string, $this->db) === false)
{
throw new Exception('Some message');
}
}
}
, , , , , .
- ? , ?:)