question about stripslashes and real_escape_string

Posted on 16th Feb 2014 07:03 pm by admin

im cleaning up an old app that I wrote fixing some of the vulernabilities from attacks.

I have roughly 30 files. I want to be able to edit every $_POST and $_GET

Code: [Select]$value=$_POST['value'];
$value=$_GET['value'];
my instinct would be to edit every file and do it manually

Code: [Select]$value=$_POST['value'];
$value=mysql_real_escape_string($value)


$value=$_GET['value'];
$value=mysql_real_escape_string($value)

but if there was a faster way it would make my life easier. What I would like to do is to maybe create a function i can put at the top of every page or into my global.php which is included into every page that would do something like this

Code: [Select]
if (get_magic_quotes_gpc()) {

$value = stripslashes($value);
}else{
$value=mysql_real_escape_string($value)

}
i dont intend to have magic quotes on, but other people might on there servers.

I just need every $_POST or $_GET within my script to be automaticly cleaned or filtered from SQL Injections

I saw something a long time ago where it was something they put at the top of there page, this will be completely wrong, but i will give u an example of what it looked like

Code: [Select]$_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string', $_POST);
$_COOKIE = array_map('mysql_real_escape_string', $_COOKIE);
$_REQUEST = array_map('mysql_real_escape_string', $_REQUEST);

im not to sure how that goes about effecting everything, where to put it, etc

Any ideas or suggestions? Or am I stuck doing it manually.

Your Answer:

Login to answer

Other forums

preg_replace question
Hello!!

I hope someone can help me with preg_replace.

I load two tables from an extern

Date Question
I'm using the TIMESTAMP() function within mysql to set the date/time for certain events. However, ho

button help
i originally had this but realised it is much easier to have a button.

Code: <?php

Export hangs
Hi all, please help

I have a Oracle 10.2.0.3.0 database. When I want to query the dba_segmen

PHP IMAGE UPLOAD SCRIPT
Hi for the last week i have been looking for scripts that will upload a photo to a certain folder wh

How to show more than 1 users with this code...
Hello,
i have a table that shows users only if I, as Administrator, want to be shown. But its sho

Credit card verification
I have a client who wants to process credit card transactions from his web site rather than the goin

Problem with PHP/mySQL login code
Hello,

There is an error in my login script and I can't figure out what it is...
I believe

How to change www in url with a specified name
Hi
I'm trying to change the url http://www.sitename.com/apparels to something like below
http:

Progress bar for webpage
Hi,
I want to implement a progress/waiting bar on my webpage - exactly the same thing that the Mi