addslashes() or mysql_real_escape_string()

[mrlister]

I noticed I have a bunch of addslashes() in vBulletin I'm running.

Are there any threats there of SQL injections? Is mysql_real_escape_string() better to use?

http://shiflett.org/blog/2006/jan/ad...-escape-string

[Dean C]

You should not use addslashes if you are inserting into a MySQL database. You should always use the native escaping function (mysql_real_escape_string )

[Dream]

On a side note, I just noticed real_escape_string existed, I must have a bunch of code around using the old function. Is this function new?

[Ryan Ashbrook]

On a side note, I just noticed real_escape_string existed, I must have a bunch of code around using the old function. Is this function new?

It was added in PHP 4.3.0.

[Dream]

Not sure when that was released... nevermind I'll check php.net.

[mrlister]

vBulletin uses addslashes() in the queries. Should I change those to the other one?

[Mike Sullivan]

3.5 and up haven't gone *near* addslashes()

[mrlister]

Lol, ok I guess that gives away what version I'm using on one of my boards