question about stripslashes and real_escape_string

Posted on 16th Feb 2014 07:03 pm by admin

im cleaning up an old app that I wrote fixing some of the vulernabilities from attacks.

I have roughly 30 files. I want to be able to edit every $_POST and $_GET

Code: $value=$_POST['value'];
$value=$_GET['value'];
my instinct would be to edit every file and do it manually

Code: $value=$_POST['value'];
$value=mysql_real_escape_string($value)


$value=$_GET['value'];
$value=mysql_real_escape_string($value)

but if there was a faster way it would make my life easier. What I would like to do is to maybe create a function i can put at the top of every page or into my global.php which is included into every page that would do something like this

Code:
if (get_magic_quotes_gpc()) {

$value = stripslashes($value);
}else{
$value=mysql_real_escape_string($value)

}
i dont intend to have magic quotes on, but other people might on there servers.

I just need every $_POST or $_GET within my script to be automaticly cleaned or filtered from SQL Injections

I saw something a long time ago where it was something they put at the top of there page, this will be completely wrong, but i will give u an example of what it looked like

Code: $_GET = array_map('mysql_real_escape_string', $_GET);
$_POST = array_map('mysql_real_escape_string', $_POST);
$_COOKIE = array_map('mysql_real_escape_string', $_COOKIE);
$_REQUEST = array_map('mysql_real_escape_string', $_REQUEST);

im not to sure how that goes about effecting everything, where to put it, etc

Any ideas or suggestions? Or am I stuck doing it manually.

Your Answer:

Login to answer

Other forums

utf8_general_ci error ??
I have all kinds of data to be inserted in database table

//I am getting this error

Yo

quick question about System Change Number(SCN) in FlashBack Query topic
i know tht we can get the SCN of the database using flashback concept as follows

SQL>

Gaining access to Drop Down Menu Variable
code is below, I am creating a drop down menu. I want to echo the value selected in the drop down me

Parse error: syntax error, unexpected T_ELSEIF in /home/......html/item.php on l
I do not know what is wrong with this. Hope some one can help. I do nto want to post the entire site

Displaying different page content, depending on the logged in user.
Hi all, I am new to ASP.net (and web development in general), and have a question about how I can di

I didnt code this but I need help with it
I'm sorry. i'm not a coder. I have this script for forcing download and previewing mp3. The guy that

Display error above the login forum help!
Hi guys. just so you know im not asking for someone to do this for me I just need to be pointed in t

Procedural to OOP
ohn Kleijn said that to avoid writing "crappy code", we should learn OOP and common OO pri

Handling text changed in text box control using Ajax
I need to create a web form with a text box control. When someone types text into the textbox I nee

unexpected T_SL without a shift left token
Nothing too see here, I'm an idiot and resolved the problem.