addslahes

[nuovo]

addslahes

[pilsetnieks]

Hi,
if you need to store anything in database, use parametrized queries (with mysqli_* functions or with PDO objects). Escaping strings and concatenating them into queries for mysql_* functions is not secure.

You should read this: http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php/12860046

Even though you shouldn't do it, there may be some situations where it's unavoidable (e.g. locked into a legacy install.) In that case you should escape the values with mysql_real_escape_string instead of addslashes. Anyway, you shouldn't add the escaping code inside the class (what would happen when you update it?), you should work on the output. E.g.

$xlsxFile = new SpreadsheetReader('/path/to/file.xlsx');
foreach ($xlsxFile as $Row)
{
    $Value = mysql_real_escape_string($Row[0], $DB);
    save_value_wherever($Value);
}