Using mysql_real_escape_string return empty

Question

I use mysql_real_escape_string to escape $this->piVars.

....de/index.php?searchGenre=5

$searchGenre = mysql_real_escape_string($this->piVars[searchGenre]);
$result = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', 'item', 'genre = ' . $searchGenre, 'title', '');

print_r($this->piVars[searchGenre]); = string "5".

var_dump($this->piVars[searchGenre]); = string(1) "9"

print_r($searchGenre) = empty String.

var_dump($searchGenre) = bool(false).

Why?

Hard to say with so little code; what is the string you're escaping? Are you connected to a database? What do you get if you var_dump($searchGenre) instead of print_r? — andrewsi
– andrewsi, Commented Aug 17, 2013 at 14:12

Yotam Omer · Accepted Answer · 2013-08-17 14:20:12Z

4

This is probably happening because you have no open mysql connection. you must first have an open connection for mysql_real_escape_string() to work.

mysql_connect('mysql_host', 'mysql_user', 'mysql_password') // open connection..
$searchGenre = mysql_real_escape_string($this->piVars[searchGenre]); // use it

Note: mysql_ functions are deprecated. Use prepared statements with PDO (or mysqli) instead.

answered Aug 17, 2013 at 14:20

Yotam Omer

15.4k11 gold badges65 silver badges65 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Using mysql_real_escape_string return empty

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related