SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

Need help: how to catch acess of undefined class properties
Hello. I am learning OO with PHP and have hit a problem.
Some code runs as perfectly valid code,

Help: calling function
Hi,
Is it possible to call a php function on page close?
If yes, could you explain how and whe

Call db table from any PHP file
Hi,

I want to be able to call a database table that will be setup in another file called init

Implementing Single Sign-On using SAML 1.1, x.509, LDAP in C#.net
Hi, I got a requirement from the client i.e implementing single sing on using SAML 1.1( LDAP &

matching numbers inside ( )
I know I can match numbers by just [0-9]+, so I thought matching numbers inside ( ) would be somethi

Save remote XML to local website folder
Hi, I hope you can help me out. I would like to be able to pull an XML file from another site and t

Weird MySQL error, why am I recieving this?
PHP Code:


<?php require "global_settings.php"; ?>
<titl

Can't seem to capture a variable in a chained select
I'm *this* close to having a chained select running but for some reason it doesn't seem to be pickin

How to use Substr
I want to check for the word CATEGORY: inside a string which can be CATEGORY: ITEM
and remove the

Scheduler problems related to execution of a single BLT by many schedules
Hello all,

We are running several MII instances in a distibuted architecture using a sing