Sql security

[Joe]

hi
i've been talking to people
*ahem*SV and Scoot*ahem*
and i believe that my sql database can be hacked.
is it possible to make it more secure
and also, what is this 'mysql_real_escape_string' and how do i use it?

thanks

Joe

 

[Scott]

mysql_real_escape_string -- Escapes special characters in a string for use in a SQL statement. This function must always (with few exceptions) be used to make data safe before sending a query to MySQL.

More information: http://www.php.net/mysql_real_escape_string

 

[bay]

You don't really need to use mysql_real_escape_string for passwords that are hashed in md5, because md5 hases will never have ' or "

The manual entry for mysql_real_escape_string is pretty self explanatory, If you want some more advanced functions check out the user comments too.

 

[Joe]

ok ty bay and Scott
some very helpful advice
*reads comments*

Joe