SQL Injection


Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Did you know?Explore Trending and Topic pages for more stories like this.
Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.
No comments posted yet

Your Answer:

Login to answer
162 Like 9 Dislike
Previous forums Next forums
Other forums

Loosing changed contents when used FM REUSE_ALV_GRID_DISPLAY
Hi,

I have used FM REUSE_ALV_GRID_DISPLAY in my program as below.

CALL FUNCT

Sort a two dimensional array.
Hi. I've set up a two dimensional array that reads as follows:

Code: $modifiedData = array(

upload only text files
hi guys i want to upload only text like like (pdf,note pad and ofiice files) so can any one please t

Varible in trigger - refering to correct schema
Hello

Im having some issues with my trigger.
What I want to do is call opon a differ

How to add an image/C++ OpenGL?
Hi,

I have been trying to look online for this and, so far, I haven't found anything usef

Problem in OnClientClick and OnClick sync
Hi,Strange and irritating problem: I have below button declaration in markup of the aspx page:

session checking in page load
hai all I have a web site is www.Mryas.com in this my login page is Page1.aspx its co

MySQL Primary key gap
Alright, so I have a table with 26 entries in it (id, filename, caption) for my image randomiser (ht

need help with php get
i have a option box that gets filled with dates, but how do i get once the option value has been cli

UDS 4.0 Datatype issue
UDS 4.0.322 -- connecting to NI Labview 9.0

When using connection method: Cache with live

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



 
© indyaspeak.com. All Rights Reserved.
Play Free Quiz and Win Cash