^ Mysql_real_escape_string

^-^ Mysql_real_escape_string many people often use mysql_real_escape_string. I have a question: is this function available only with mysql extensions? if I use an oracle database. I didn't open mysql_real_escape_string. what should I do. I checked php.net, which has the following functions, basically targeting every database. I ^-^ good question about mysql_real_escape_string
Everyone often uses mysql_real_escape_string. I have a question: is this function available only when mysql extension is enabled? if I use an oracle database. I didn't open mysql_real_escape_string. what should I do.

I checked php.net, which has the following functions, basically targeting every database. My question: Is there a general mysql_real_escape_string like this?

Mysql_real_escape_string
Maxdb_real_escape_string
Ingres_escape_string
Cubrid_real_escape_string
Pg_escape_string
Mysql_escape_string
Maxdb_escape_string
Dbx_escape_string
Db2_escape_string
Mysqli_escape_string
Sqlite_escape_string

Another question is: can mysql_real_escape_string completely prevent SQL injection?

------ Solution --------------------
To understand the efficacy of mysql_real_escape_string, you can use methods such as regular expressions. it is unclear if you need to install extensions.

2nd questions
The mysql_real_escape_string function is used to escape special characters in the strings used in SQL statements. it is not used to defend against SQL injection attacks. Therefore, you have an answer to this question.
It cannot be said that escape is 100% safe. I have seen some time ago that I converted 'into a hexadecimal format, but mysql can recognize it normally. Of course, I did not test whether this statement is true or not, but I believe the hackers are thinking about it every day.

I plan to write a post recently to discuss this disturbing issue.
------ Solution --------------------
I have been paying attention to SQL injection recently, but I don't know much about it. so I hope to write a post to discuss it with you. thank you for your advice.

Here is a dz

$ Magic_quotes_gpc = get_magic_quotes_gpc ();
@ Extract (daddslashes ($ _ COOKIE ));
@ Extract (daddslashes ($ _ POST ));
@ Extract (daddslashes ($ _ GET ));
If (! $ Magic_quotes_gpc ){
$ _ FILES = daddslashes ($ _ FILES );
}

Function daddslashes ($ string, $ force = 0 ){
If (! $ GLOBALS ['Magic _ quotes_gpc '] | $ force ){
If (is_array ($ string )){
Foreach ($ string as $ key => $ val ){
$ String [$ key] = daddslashes ($ val, $ force );
}
} Else {
$ String = addslashes ($ string );
}
}
Return $ string;
}
Echo daddslashes ('jafoakfok * & % ^ :"');

Others wrote

Function str_filter ($ str ){
$ Str = htmlspecialchars ($ str );
If (! Get_magic_quotes_gpc ()){
$ Str = addslashes ($ str );
}
// Filter dangerous characters
Return preg_replace ("/[\" \ '=] | (and) | (or) | (create) | (update) | (alter) | (delete) | (insert) | (count) | (% 20) | (char)/I "," ", $ str );
}

There should be a lot of online resources.
------ Solution --------------------
Mysql does not apply to sqlite, and sqlite does not apply to mysql.
------ Solution --------------------
Discussion
I checked php.net, which has the following functions, basically targeting every database. My question: Is there a general mysql_real_escape_string like this?

Another question is: can mysql_real_escape_string completely prevent SQL injection?
------ Solution --------------------
Kiss PDO: Quote is just adding introduction... hahaha is not sending out-of-band notifications.

------ Solution --------------------
PDO: Quote
Mysql_real_escape_string

All Escape Special characters
The difference is that the latter is only for mysql, and the former can be used for all databases.
Note that different databases have different results for special characters and escape characters.

As for PDO: The Quote will provide a pair of single quotes for consideration.
This function will be called internally during dynamic binding. Parameters in the pre-processed SQL expressions do not need to be enclosed in single quotes. However, the SQL commands passed to the database are mandatory.


------ Solution --------------------
Not even

PHP code

$ Db = new PDO ('MySQL: dbname = test'); $ ar = array ('A', "B 'B", 123 ); $ ar = array_map (array ($ db, 'quote'), $ ar); echo join (',', $ ar );
------ Solution --------------------
The difference between mysql_real_escape_string and other common escape functions is that it is encoded securely and will be encoded according to your cient code.
(Use mysql_set_charset to set encoding) to analyze strings rather than full ansi processing

PDO: Quote is enclosed in quotation marks because prepare is generally written as follows:
WHERE calories <? AND color =?
In this way, the quote adds quotation marks based on the variable type, rather than the string.
------ Solution --------------------
This topic is interesting to discuss.
------ Solution --------------------

It is said that before the new version, set xxx cannot be remembered. The new version has a character setting method, which is not recommended in all previous solutions.

Mysql_real_escape_string is encoded with the highest security level. Higher than addslash. It is encoded securely.