-1

How to add mysql_real_escape_string() after str_replace()?

$s='+'.str_replace(' ',' +',rawurldecode($_GET['search']));

$sql = '
SELECT * from table 
where match 
(keywords) 
AGAINST 
('".mysql_real_escape_string($s)."' IN BOOLEAN MODE) 
order by date desc 
limit '.mysql_real_escape_string($_GET['number']).',10
';

Is this the correct way to write the mysql_real_escape_string() in such a mysql full text search? Thanks.

Funk Forty Niner
  • 74,450
  • 15
  • 68
  • 141
yuli chika
  • 9,053
  • 20
  • 75
  • 122
  • Please, [don't use mysql_* functions in new code](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). They are no longer maintained and are officially deprecated. Learn about [prepared statements](http://en.wikipedia.org/wiki/Prepared_statement) instead, and use [PDO](http://php.net/pdo) or [MySQLi](http://php.net/mysqli) — [this article](http://php.net/manual/en/mysqlinfo.api.choosing.php) will help you decide which. If you choose PDO, [here is a good tutorial](http://wiki.hashphp.org/PDO_Tutorial_for_MySQL_Developers). – user555 Dec 22 '13 at 15:19
  • No, this is not safe. And the first `mysql_real_escape_string` isn't processed, but passed as plain text (if there weren't a syntax error). – Marcel Korpel Dec 22 '13 at 15:23

1 Answers1

-1

Yes, it is almost correct way (you have bad quote order), but functions you are using are depracted. Use mysqli. You should alsu use intval() because user can input text value and it generates error.

$sql = '
SELECT * from table 
where match 
(keywords) 
AGAINST 
("'.mysql_real_escape_string($s).'" IN BOOLEAN MODE) 
order by date desc 
limit '.intval($_GET['number']).',10
';
P.W-S
  • 167
  • 9