If someone hacks the database, it's sort of a moot point, don't you think? You've got to figure they're proficient enough to workaround / discover your encryption key and get the data.

You can also, if you know the input can only be alphanumeric, is to build a function (which could be used for other things as well), which replaces all characters except any alphanumeric ones. However, out of addslashes() and mysql_real_escape_string(), the latter is definitely the best choice.

I like the sprintf way Wildhoney taught me. There will always be different ways to hack into the source but sprintf, mysql_real_escape_string (or without _real), addslashes and such will prevent almost anything.

Wrapping all your variables in single quotes is the easiest way. It's what the mysql manual recommends.

__________________