We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 1764
    • 680 Posts
    I noticed that we don’t have any SQL string escaping functions as a part of the DB API. I had to use mysql_escape_string which would break MS SQL Server and other DBs.

    This is obviously a fairly simple addition, I’ve entered it into the bug tracker and hopefully we can get it added in fairly soon. I don’t think it would have to be anything other than a wrapper for the mysql_escape_string function.

    Is there anything anybody would like to add?
      • 25663 MODX Staff
      • 12,272 Posts
      Feel free to whip up a quick example set of code if you can, and we’ll get it reviewed and committed to SVN. Good catch, btw! wink
        Ryan Thrash, MODX Co-Founder
        Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
        • 1764
        • 680 Posts
        The code below should do it. It needs to be added inside of the DBAPI class in the dbapi.mysql.class.inc.php file.

        I added the check for mysql_real_escape_string because I wasn’t sure if we are supporting PHP versions prior to 4.3. I didn’t see any minimum requirements on the site anywhere.

        	/**
        	 *	@name:	escapeString
        	 *	@desc:  escapes special characters to prepare a string for SQL query insertion
        	 *	@param:	$fugitiveString - the string that needs to be escaped
        	 */
        	function escapeString($fugitiveString) {
        
                // Use "real" function if we have a new enough version, otherwise use the depricated function
                if(function_exists('mysql_real_escape_string')) {
                    $fugitiveString = mysql_real_escape_string($fugitiveString, $this->conn);
                } else {
                    $fugitiveString = mysql_escape_string($fugitiveString);
                }
                
                return $fugitiveString;
        
            }
        
          • 25663 MODX Staff
          • 12,272 Posts
          Thanks!
            Ryan Thrash, MODX Co-Founder
            Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
            • 32963
            • 1,732 Posts
            Quote from: aNoble at Aug 18, 2005, 12:59 AM

            I added the check for mysql_real_escape_string because I wasn’t sure if we are supporting PHP versions prior to 4.3. I didn’t see any minimum requirements on the site anywhere.

            Thanks man. I was going through the bug lis when I found the "DB Escape String method" and add a similar function called $modx->db->escape() that’s just a wrapper around the mysql_escape_string like you had suggested.

            MODx we supports PHP version 4.1 and higher.
              xWisdom
              www.xwisdomhtml.com
              The fear of the Lord is the beginning of wisdom:
              MODx Co-Founder - Create and do more with less.