Re: SQL injection and PHP/MYSQL

[Jan Pieter Kunst <jpk () akamail com>]

> After using mysql_escape string to insert data into the database, is there
> an equal combination of unescaping one should do when the date is pulled
> from the database, or is a stripslashes() all that is necessary?


You shouldn't have to do a stripslashes() when you retrieve data from 
a MySQL database.

The slashes that are added to escaped data aren't themselves stored 
in the database. At least, the addslashes() ones aren't.

JP