question about stripslashes and real_escape_string

Posted on 16th Feb 2014 07:03 pm by admin

im cleaning up an old app that I wrote fixing some of the vulernabilities from attacks.

I have roughly 30 files. I want to be able to edit every $_POST and $_GET

Code: [Select]$value=$_POST['value'];
$value=$_GET['value'];
my instinct would be to edit every file and do it manually

Code: [Select]$value=$_POST['value'];
$value=mysql_real_escape_string($value)


$value=$_GET['value'];
$value=mysql_real_escape_string($value)

but if there was a faster way it would make my life easier. What I would like to do is to maybe create a function i can put at the top of every page or into my global.php which is included into every page that would do something like this

Code: [Select]
if (get_magic_quotes_gpc()) {

$value = stripslashes($value);
}else{
$value=mysql_real_escape_string($value)

}
i dont intend to have magic quotes on, but other people might on there servers.

I just need every $_POST or $_GET within my script to be automaticly cleaned or filtered from SQL Injections

I saw something a long time ago where it was something they put at the top of there page, this will be completely wrong, but i will give u an example of what it looked like

Code: [Select]$_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string', $_POST);
$_COOKIE = array_map('mysql_real_escape_string', $_COOKIE);
$_REQUEST = array_map('mysql_real_escape_string', $_REQUEST);

im not to sure how that goes about effecting everything, where to put it, etc

Any ideas or suggestions? Or am I stuck doing it manually.

Your Answer:

Login to answer

Other forums

Appending GET data with form submition
Okay, what I'm trying to do is to use a form to append an already existing GET data string.

I

apart from cron
I need to run a php file every one hour. Is there any other solution apart from cron job?

How to get all server headers like Live http Headers does
Hey all, like many of you I use the Firefox addon "Live http Headers". I'm trying to write

DataTable Help Required
Hi all I am creating an app that utilises and MS Access back end and queries it quite a bit at vario

Post, not working, please help
The error is:
Method Not Allowed
The requested method POST is not allowed for the URL /student

displaying email without attracting a ton of spam
Hello,

this is maybe the wrong place to ask.
How would you display an email address on a w

Custom list order
Hi there,

I have checked this tutorial and it's great till the point where I want to display

Take info from one coloum and move to another
Hi all,

I have this:
Code: [Select]$array = "SELECT stock_id FROM stocks WHERE stock_

ereg_replace issue
hi there people

i have this code happening with regards to my wamp server. is this something

Target costs on Process orders not calculating
Hi All,

We have released standard costs for all the materials. We have also done Goods r