question about stripslashes and real_escape_string

Posted on 16th Feb 2014 07:03 pm by admin

im cleaning up an old app that I wrote fixing some of the vulernabilities from attacks.

I have roughly 30 files. I want to be able to edit every $_POST and $_GET

Code: [Select]$value=$_POST['value'];
$value=$_GET['value'];
my instinct would be to edit every file and do it manually

Code: [Select]$value=$_POST['value'];
$value=mysql_real_escape_string($value)


$value=$_GET['value'];
$value=mysql_real_escape_string($value)

but if there was a faster way it would make my life easier. What I would like to do is to maybe create a function i can put at the top of every page or into my global.php which is included into every page that would do something like this

Code: [Select]
if (get_magic_quotes_gpc()) {

$value = stripslashes($value);
}else{
$value=mysql_real_escape_string($value)

}
i dont intend to have magic quotes on, but other people might on there servers.

I just need every $_POST or $_GET within my script to be automaticly cleaned or filtered from SQL Injections

I saw something a long time ago where it was something they put at the top of there page, this will be completely wrong, but i will give u an example of what it looked like

Code: [Select]$_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string', $_POST);
$_COOKIE = array_map('mysql_real_escape_string', $_COOKIE);
$_REQUEST = array_map('mysql_real_escape_string', $_REQUEST);

im not to sure how that goes about effecting everything, where to put it, etc

Any ideas or suggestions? Or am I stuck doing it manually.

Your Answer:

Login to answer

Other forums

need help with php get
i have a option box that gets filled with dates, but how do i get once the option value has been cli

Give me all your tricks for minimizing jar file size

Hi, I'm coming close to releasing my J2ME game... I am kicking up against the 64k size barrier w

Could Someone Please Debug This?
I was wondering if someone could debug this script for me. I realize it's not the tidest script (and

Problem with DB connection
Hello there! I'm new to this forum and I'm new to PHP coding also. I wrote something that doesn't ma

Displaying image from database
Hi,

I've got a site where that's got a database behind it. Currently it has loads of items in

Help with looping
I have a comma separated list of colors taken from a database ($ICo) and a directory of images named

Php navigation
I have four buttons on a php page.
If i click a button it will redirect to different php pages.

Display error above the login forum help!
Hi guys. just so you know im not asking for someone to do this for me I just need to be pointed in t

Solution to the FindControl problem
I have seen may posts about having problems with the FindControl method. Most seem to come about bec

query based on 2 conditions
I want to select if the doc_type is either s OR f but this doesn't work:

Code: [Select]$query