[geeklog-devel] MS SQL escaping

[Joe Mucchiello]

At 08:34 AM 7/4/2008, Michael Jervis wrote:
>The right one is the one I Committed to fix issues with the installer ;-)
>
>" does not require escaping in SQL. ' does, and is escaped as ''
>
>Geeklog escapes " to \" then passes that in, so we need to change \"
>to " in passed in SQL Strings.

That's because GL uses the unrecommended addslashes to quote database 
strings instead of a GL specific function, such as DB_quoteText. If 
such a function existed, the mysql.class.php version would call 
mysql_real_escape_string and the mssql.class.php version would just 
expand (single tick) to (two single ticks) as done in standard SQL.


----
Joe Mucchiello
Throwing Dice Games
http://www.throwingdice.com