Scripting/Squirrel/Functions/mysql escape string

Escapes a query string to avoid sql injection attacks. This function should be used for every executed query that uses any data given by the players.

Syntax

mysql_escape_string( MySQLConnection handler, string query )

Arguments

• MySQLConnection handler - A valid MySQL link/handler
• String query - The string to escape

Return value

The escaped string.

Example

function onPlayerJoin( player )
{
   local pName = mysql_escape_string( handler, player.Name );
   local q = mysql_query( handler, "SELECT * FROM Accounts WHERE Name='" + pName + "'" );
   //Do stuff here
}

By KAKAN