mysql_real_escape_string function for MS SQL?

[irbk]

I've used PHP w/MySQL with great sucess in the past. Now I'm trying to convert some of my code to use SQL instead. I have a function...

function escape_data ($data) { // Create a function for escaping the data.
global $dbc; // Need the connection.
if (ini_get('magic_quotes_gpc')) {
$data = stripslashes($data);
}
return mysql_real_escape_string($data, $dbc);
}

Works very well for escaping data in MySQL. I'd like to use the same function in MS-SQL however I didn't see anything in the Doc's on php.net. Does a function like this exist for MSSQL?

Thanks in advance!

 

[irbk]

Any one have a function built to clean up input that will work with MS SQL?

 

[jpadie]

there is some discussion on escaping for mssql in the manual

http://fr.php.net/manual/en/function.mssql-query.php

you might also look at the code of the PEAR:B class which handles escaping natively if you use placeholders. it may have a nifty preg_replace or the like.

 

[KarveR]

Personaly I cant see why your existing function wouldn't actually work perfectly for ms-sql the way it stands, afaik the charcters to be escaped would be the same ?

______________________________________________________________________
There's no present like the time, they say. - Henry's Cat.

 

[KarveR]

There is however one drawback ...

Note: A MySQL connection is required before using mysql_real_escape_string()

Hmm, a flaw in the best of plans.

______________________________________________________________________
There's no present like the time, they say. - Henry's Cat.

 

[jpadie]

but such connection is not required for mysql_escape_string.

for the real_escape_string a connection is required so that php can discern the character set that is in use.

i don't use mssql myself so can't comment on whether mysql escaping will work on mssql.

 

[irbk]

I can tell you that as it stands the mysql_real_escape_string does not work with MS-SQL. Probally as is noted above, because a mysql connection is required to determine the character set.

 

[jpadie]

i suspect that is the case.

i believe (on very little evidence) that mssql does not need to have any characters escaped other than the single quote and that the escape character is another single quote.

ie. john's becomes john''s

so this is as simple as

$escaped_text = str_replace("'", "''", $text);

note that you need to undo the horrors of magic quotes first of course:

if (get_magic_quotes_gpc()) {
 $val = stripslashes($val);
}

and if you have magic_quotes_runtime switched on you ought (to be shot) to switch it off at the beginning of your script

set_magic_quotes_runtime(0);

 

[irbk]

I'm using tinymce to input the data into the var's. I *think* tinymce might already escape the single quote. Have to test that out....