Safely escaping a variable in a raw SQL query

alamak

New Member
Im just wondering, would the following be completely safe or would someone be able to get around it using hexadecimal characters, etc:\[code\]$name = mysql_real_escape_string(htmlentities(stripslashes($_REQUEST['name'])));$query ="SELECT * FROM Games WHERE name LIKE '%{$name}%'";\[/code\]Thanks.I know I can use PEAR and other libraries to make prepeared statements. However this question is specifically regaring raw queries.
 
Back
Top