Edit Question - KnowledgeHub

Title Body

I am working on a project that uses OSCommerce with MySQL and I'm confused as to when I should use tep_db_input() or tep_db_prepare_input(). I'd assume I should use tep_db_input() around any strings that are being inserted/updated, but then when should the other function be used? For example, if I were to SELECT some data from the database, and use the result to then INSERT a row into another table, do I need to prepare the input at some point? Or just use tep_db_input again? $width = '3"'; // 3 inches $new_height = '3\' 5"'; // 3 feet 5 inches $result = tep_db_query( "SELECT height FROM measurements WHERE width = '".tep_db_input($width)."'" ); while ($row = tep_db_fetch_array($result)) { tep_db_query( "INSERT INTO measurement_history ( field, old_value, new_value ) VALUES ( 'height', '".tep_db_input($row['height'])."', '".tep_db_input($new_height)."' )" ); } Is this correct? Edit:: In case anyone isn't familiar with those functions, here are their definitions: function tep_sanitize_string($string) { $patterns = array ('/ +/','/[<>]/'); $replace = array (' ', '_'); return preg_replace($patterns, $replace, trim($string)); } function tep_db_input($string, $link = 'db_link') { global $$link; if (function_exists('mysql_real_escape_string')) { return mysql_real_escape_string($string, $$link); } elseif (function_exists('mysql_escape_string')) { return mysql_escape_string($string); } return addslashes($string); } function tep_db_prepare_input($string) { if (is_string($string)) { return trim(tep_sanitize_string(stripslashes($string))); } elseif (is_array($string)) { reset($string); while (list($key, $value) = each($string)) { $string[$key] = tep_db_

Tags (comma-separated) Cancel