Simple db_query question

[duongduythao]

Hi
I have simple security question:
strings used in $smcFunc['db_query'] need to be escaped?
or the function do this?

[Suki]

This is a simple example of a query using $smcFunc:

Code Select Expand


$result = $smcFunc['db_query']('', '
SELECT poster_time
FROM {db_prefix}messages
WHERE id_msg = {int:id_msg}
LIMIT 1',
array(
'id_msg' => $user_settings['id_msg_last_visit'],
)
);

note the {int:id_msg}  which is SMF's own way to parametize your queries

theres a few types you can use, can't remember all of them but heres a list:

int
raw
float
array_int
array_string
string

SMF will do the escape for you.