question about stripslashes and real_escape_string

Posted on 16th Feb 2014 07:03 pm by admin

im cleaning up an old app that I wrote fixing some of the vulernabilities from attacks.

I have roughly 30 files. I want to be able to edit every $_POST and $_GET

Code: [Select]$value=$_POST['value'];
$value=$_GET['value'];
my instinct would be to edit every file and do it manually

Code: [Select]$value=$_POST['value'];
$value=mysql_real_escape_string($value)


$value=$_GET['value'];
$value=mysql_real_escape_string($value)

but if there was a faster way it would make my life easier. What I would like to do is to maybe create a function i can put at the top of every page or into my global.php which is included into every page that would do something like this

Code: [Select]
if (get_magic_quotes_gpc()) {

$value = stripslashes($value);
}else{
$value=mysql_real_escape_string($value)

}
i dont intend to have magic quotes on, but other people might on there servers.

I just need every $_POST or $_GET within my script to be automaticly cleaned or filtered from SQL Injections

I saw something a long time ago where it was something they put at the top of there page, this will be completely wrong, but i will give u an example of what it looked like

Code: [Select]$_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string', $_POST);
$_COOKIE = array_map('mysql_real_escape_string', $_COOKIE);
$_REQUEST = array_map('mysql_real_escape_string', $_REQUEST);

im not to sure how that goes about effecting everything, where to put it, etc

Any ideas or suggestions? Or am I stuck doing it manually.

Your Answer:

Login to answer

Other forums

Help? Need help on project with templates involving mysql and php.
I'm having a hard time explaining what I want but basically here is what I have in place:

-Da

Trouble verifying database password
Thankyou to everyone who responded to my last post (I can't find the posting, it has been buried). <

How to change Time Zone
HI
I want to change the time zone of the server to another country.How can do that?

Thanks

Procedural to OOP
John Kleijn said that to avoid writing "crappy code", we should learn OOP and common OO pr

How to ask a regex question?
Hi, I thought I'd share some of my insight after seeing too many bad questions that either get ignor

Getting Resource id #11 while trying to connect..
So i tried using "DEFINE" for the first time and im using the variables i defined to conne

limit string by words??
hello all,

I was wonder if there is a function to limit a string by the number of words inste

have trouble in a if condition
The if below is working ok, it check when indexes, name, zipcode and state are empty.
Code: &

Help to integrate whois Domain Details to website
Hi,

can i know is their any php script r methods to add domain details to my website.

need help in update query
hi
i have a dynamic form. i need help in how can i use update query when values from dynamic for