[rebug]

I would like your opinion on this method to avoid any sql injection :

My request to database is always like this:

PHP Code


<?php 
$request = odbc_exec($mssql, 'SELECT COUNT(*) as count FROM [%NAME%] WHERE %value%=\''.mssql_escape_string($_GET['%GETPARAM%']).'\''); 


My function mssql escape string :

PHP Code


<?php 
function mssql_escape_string($string) {
        $replaced_string = str_replace("'", "''", $string);
        return $replaced_string;
    } 


Thx

[Snickerson]

Look into prepared statements. php.net/manual/en/mysqli.quickstart.prepared-statements.php

[ApertureSecurity]

Prepared statements are NOT always enough.

https://stackoverflow.com/questions/6017...ion-in-php