SQL Injection


Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Did you know?Explore Trending and Topic pages for more stories like this.
Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.
Trending TodaySee what people are reading
No comments posted yet

Your Answer:

Login to answer
162 Like 9 Dislike
Previous forums Next forums
Other forums

i want run some web server under the ip sharer
hello i want run some web server under the ip sharer
my ip is floating ip but it doesnt matter

Progress bar tracking file downloads
Hey guys, was wondering if there was a way to track how far a file has been downloaded. I know there

SQl num_rows problem
when i try to count rows from an SQL select i get an warning

Code: [Select]$countviews = mysq

The page should be expire when cilck back button
hi,
i'm new to php world.
i create user registration page.
when i submit it,data goes to my

Help? Need help on project with templates involving mysql and php.
I'm having a hard time explaining what I want but basically here is what I have in place:

-Da

update post issues
I am trying to create an update to a post function, while the update does occur, the page routing an

Problem with umlauts and UTF-8
Hello every1,

I'm creating my own little CMS at the moment and got some problems with the cha

Am i doing this wrong?
Im pulling from an Oracle database some info... one of which is a field count_pnums which is a NUMBE

utf8_general_ci error ??
I have all kinds of data to be inserted in database table

//I am getting this error

Yo

mysql select query problem
how can i select multiple fields from multiple table in one query like

i have table name t1 a

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



 
© indyaspeak.com. All Rights Reserved.
Play Free Quiz and Win Cash