escaped_query="INSERT INTO t (a,b) VALUES ('$!some','$!thing');
The "!" means "escape this variable".
That would be the easiest way to create queries with escaped parameters.
Something like ...
foreach($_REQUEST as $k=$v) {
$REQUEST[$k] = mysql_real_escape_string($v);
}
$query = "INSERT INTO table VALUES('$REQUEST[email]', '$REQUEST[name]')";
You could also do something like ...
$query = "INSERT INTO table VALUES('{$e('email')}', '{$e('email')}')";
$e = 'esc';
function esc($v) {
mysql_real_escape_string($v);
}
old way:
$sql_email=mysql_real_escape_string($email);
$sql="UPDATE t WHERE id=123 SET email='$sql_email'";
$sql="UPDATE t WHERE id=123 SET email='{$e($email)}'";