PHP - Simple Problem With Mysql_real_escape_string, Please Help!

I have an AJAX script which queries a DB when a user inputs a search text. That's great, works well.

However, when I use mysql_real_escape_string, it seems to completely rid the '$q'. When I don't use it, it works well but of course, there's the security side of things.

Here's the code snippet:

<?php
error_reporting(E_ALL);
$q = $_GET["q"];//added mysql_real_escape_string
//$q = mysql_real_escape_string('$_GET["q"]');

$con = mysql_connect("localhost","aaaaa","aaaaa");

if (!$con)
{
die('Could not connect: ' . mysql_error());
}

mysql_select_db("aaaaa", $con);

$sql="SELECT * FROM articles WHERE keywords LIKE '%$q%'";
?>

It seems so simple, but its just not working. What could it be?

Good morning,   I am trying to implement a simple sanitization of data before inserting in my database and am having a little trouble due to the fact that I am using a third party script that is accessing posted variables in a way that is unfamiliar to me... here's the data. The problem area is red. The form simply hangs up when submitted.  I have used this method in the past, but not with an object operator.    // insert into database

Hello All,

Wondering if someone can help.  I have a piece of code which I use on all data I post to my database which uses mysql_real_escape_string on all my forms for security purposes that I found on t'internet:


if(!get_magic_quotes_gpc()){
$_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string', $_POST);
$_REQUEST = array_map('mysql_real_escape_string', $_REQUEST);
$_COOKIE = array_map('mysql_real_escape_string', $_COOKIE);
} 


However, ever since i've installed this i'm having problems with other elements, such as deleting records from a MYSQL database like so:


<?php
$msg = "";
if(isset($_POST['Submit'])){
    $total = $_POST['total'];
    $news_ids = $_POST['nws_id'];
    foreach($news_ids as $id){
        mysql_query("DELETE FROM news WHERE news_id='$id'");
    }
$msg = count($news_ids) . " News Item(s) deleted!";
}
$result = mysql_query("SELECT *, DATE_FORMAT(published, '%d-%m-%Y') as formatted_date from news order by news_id desc;");
$num = mysql_num_rows($result);
$n = 0;
?>


Yet if I delete the piece of code above code it works fine, but I don't understand why the above code effects this?  Anyone plese help me understand?

Thanks

hey guys,
just wondering, is it advisable to use mysql_real_escape_string() with <select> boxes, i know the web designer will always set the values for options within select boxes, therefore there shouldn't be any danger, but then i found such js code as:

Code: [Select]
javascript:document.body.contentEditable='true'; document.designMode='on'; void 0
(this allows the user of any site to edit content on the users end)

so with something like the above, is it at all possible for a user to alter the option values within a select box and successfully submit the altered form?

thanks

Is it correct to use mysql_real_escape_string() function on every query that i wonna insert or search ?
I have fields like TEXT(dectription of article), VARCHAR(name of article) and more like that, and is there correct to use mysql_real_escape_string for all fields when query is INSERT  ?