how can I tell if mysql_real_escape_string is working

As it says in the title , how can I tell if the mysql_real_escape_string is working h开发者_运维技巧ow it should without waiting to be hacked ?

Check the values you get back from it.

Send it some text that it should escape, such as Ed O'Neil (Which should come back as Ed O''Neil or Ed O\'Neil)

Create a unit test that sends it all characters it should escape and checks it output.

BUT: Why don't you simply use parameterized queries with PDO? Like:

$dbh = new PDO([...]);
$sth = $dbh->prepare("SELECT foo FROM bar WHERE baz=:baz");
$sth->execute(array(":baz" => $mybaz));

It is the safest way and thanks to PDO it's nearly as easy as in Perl.

To expand on what 'R. Bemrose' offered, here is some sample code to do just that. Be sure to replace the mysql credentials with your own.

<?php
// Connect
$link = mysql_connect('mysql_host', 'mysql_user', 'mysql_password')
    OR die(mysql_error());

$user = "Ed O'Neil";
$password = "SQL_INJECTION ';'alter table xyz';";

// Query
$query_safe= sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
            mysql_real_escape_string($user),
            mysql_real_escape_string($password));

// Query
$query_not_safe= sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
            $user,
            $password);

echo $query_safe."\n";
echo $query_not_safe;

?>