https://www.icyphoenix.com/viewtopic.php?f=17&t=9351&p=59920#p59920
-----------------------------------
Informpro
Tue 25 Nov, 2014 10:10

Re: More Questions About Sanitizing?
-----------------------------------
Right – `request_var` isn't a php function, but you should be able to "steal it" easily.

For your last question, no, I don't think it's wise to mysql_real_escape_string here. I think you should only use that function when you're inserting stuff in the DB.

(and BTW, I'd probably use a function "on top of" `mysql_real_escape_string`, like IP has `$db->sql_escape()`, so that if you need to change the database later it'll be easy. You might want to look into php's PDO)


