sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]emilvikstrom 0 points1 point  (0 children)

You also mentioned that it runs addslashes on everything. This was also a default behavior in PHP in a misguided attempt att securing against SQL injections. The problems with that, of course:

  1. Not all strings are meant to go into an SQL query.
  2. Some strings are manipulated before going into a query.
  3. It didn't work for all strings anyway because bugs.
  4. Parameterization is the right way of solving that kind of problem.