CODEWITHSUNDEEP
phpjavascriptajaxmysql-real-escape-stringencodeuricomponent
simPod
simPod

Reputation: 13466

encodeURIComponent and mysql_real_escape_string

I would like to ask you if it's necessary to use a mysql_real_escape_string() PHP function for data that I send into my DB in PHP ajax file if the data is encoded in my JS file using encodeURIComponent() function? thanks

Upvotes: 1

Views: 659

Answers (1)

Piskvor left the building
Piskvor left the building

Reputation: 92772

Yes. encodeURIComponent encodes the characters so they aren't misinterpreted in the URL (in transport via HTTP); mysql_real_escape_string escapes the string so that it isn't misinterpreted in the MySQL query (inside the database).

In other words, each has a completely different function; not to mention that you have zero guarantee that the request at your PHP file is actually coming from your AJAX call.

Upvotes: 2

Related Questions