Очистка пользовательских параметров MySQL

Какие языки вам нужно поддерживать? Гораздо лучше использовать встроенную очистку языка, чем писать свою собственную.

Обновлено: глядя на mysql_real_escape_string на php.net:

mysql_real_escape_string() calls MySQL's library function mysql_real_escape_string, which prepends backslashes to the following characters: \x00, \n, \r, \, ', " and \x1a.

mysql_real_escape_string () из документов mysql.com:

The string in from is encoded to an escaped SQL string, taking into account the current character set of the connection. The result is placed in to and a terminating null byte is appended. Characters encoded are NUL (ASCII 0), “\n”, “\r”, “\”, “'”, “"”, and Control-Z (see Section 8.1, “Literal Values”). (Strictly speaking, MySQL requires only that backslash and the quote character used to quote the string in the query be escaped. This function quotes the other characters to make them easier to read in log files.)

mysql_real_escape_string () учитывает набор символов, поэтому репликация всех его возможностей (особенно против проблем с многобайтовыми атаками) - непростая задача.

Из http://cognifty.com/blog.entry/id=6/addslashes_dont_call_it_a_comeback.html:

AS = addslashes()  
MRES = mysql_real_escape_string()
ACS = addcslashes() //called with "\\\000\n\r'\"\032%_"

Feature                                         AS     MRES    ACS
escapes quote, double quote, and backslash      yes    yes     yes
escapes LIKE modifiers: underscore, percent     no     no      yes
escapes with single quotes instead of backslash no     yes*1   no
character-set aware                             no     yes*2   no
prevents multi-byte attacks                     no     yes*3   no