title: Do i have to change all my htmlspecialchars ... ENT_QUOTES in mysql_real_escape_string?
body: <p>i wanted to protect my website from sql injections and other possible risks, so i changed all my sql queries by adding for each variable something like this :</p>
  <pre><code> $getLid = htmlspecialchars($_GET[lid], ENT_QUOTES);
  </code></pre>
  <p>For my 50 files... But i have just seen that it might be my mistake : i should have added mysql_real_escape_string for any &quot;input&quot;...</p>
  <p>Is it still better to use <code>mysql_real_escape_string</code> in this case, or the <code>ENT_QUOTES</code> works also? Do i have to restart again and add <code>mysql_real_escape_string</code> instead of my <code>htmlspecialchars(..., ENT_QUOTES);</code> ?</p>
  <p>Edit :</p>
  <p>Do you mean something like that?</p>
  <pre><code>$getLid = escape_string($str);
  
  function escape_string($str){
      return mysql_real_escape_string($str);
  }
  </code></pre>
  <p>Edit n°2 :  the return statement does not work properly, would you know why?</p>
  <blockquote>
  <p>Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in … www/escape_file.php</p>
  <p>Access denied for user in … www/escape_file.php</p>
  </blockquote>
  <p>Thanks</p>