PHP addslashes using array -

i attempting update multiple records using 1 form, have run problem in attempting use addslashes function.

the form looks this:

<form name="form1" method="post" action="editnewscategorysubmit.php"> <table width="405"> <tr> <td width="246"><span class="link1">news category </span></td> <td width="146" colspan="2"><span class="link1">delete?</span></td> </tr> <tr> <td> <input type='text' name='title[]' value='$title' style='width:700px;'> <input type='hidden' name='id[]' value='$id'> </td> <td> <div style='padding-left:8px;'><a onclick='return confirmsubmit()' href='deletenewscategory.php?id=$id'><img src='images/delete.jpg' border='0'></a></div> </td> </tr>                                <tr> <td><input name="image" type="image" src="images/submit.png" alt="submit form" border="0" /></td> <td colspan="2">&nbsp;</td> </tr> </table> </form> 

the php code processes looks this:

$identity = $_request['id']; $title = addslashes($_request['title']); include 'connection.php'; for($i=0;$i<count($identity);$i++) { $query = "update newscategory set title = '$title[$i]' id = '$identity[$i]'"; $result = mysql_query($query) or die(mysql_error()); } echo "success. news categories updated."; include 'return.php'; 

the warning returned is:

warning: addslashes() expects parameter 1 string, array given in /home/u180175506/public_html/editnewscategorysubmit.php on line 71

what trying addslashes (or i'm reading, using mysql_real_escape_string preferred!) each value prior updating table. there i'm missing? thanks!

there multiple ways run function on array. simple loop:

$stillnotsafedata = array(); foreach ($_request $key => $value) {     if (!is_array($value)) {         $stillnotsafedata[$key] = addslashes($value);     } else {         foreach ($value $innerkey => $innervalue) {             $stillnotsafedata[$key][$innerkey] = addslashes($innervalue);         }     } } 

or using array_walk_recursive:

array_walk_recursive($_request, function(&$item, $key) {     $item = addslashes($item); }); 

but note should not use addslashes this. once have valid connection mysql using mysql_* functions can same thing using mres.

but neither should that. mysql_* functions has been officailly deprecated time (and removed in less year language core).

besides fact removed there "edge" cases around it: sql injection gets around mysql_real_escape_string()

long story short: stop using mysql_* functions.

what want use either mysqli or pdo. these support prepared statements , bound parameters. post this: how can prevent sql injection in php?