Re: Anti-sql injection function
That should work, the trim probably isn't necessary.
Also remember that mysql_real_escape_string() does not escape % and _. These are wildcards in MySQL if combined with LIKE, GRANT, or REVOKE.
If you use LIKE to compare an input string, use = instead:
SELECT *
FROM `BankAccounts`
WHERE `baAccountName` = CONVERT( _utf8 'Somename'
USING latin1 )
COLLATE latin1_swedish_ci