SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

Need help to modify php ELSE code
I'm trying to find a way to have the php code display a message if there is no inventory listed in t

I need desperate help with this php code integrated with flash please
Can someone please help me with this php code which I have been stuck on for weeks . I am trying to

Inserting a variable in a link
I have this code that I want to insert for my own variable but I have no idea how. This is what I wa

constructor ?
i have written this program and made 3 constructors in the class and i want to call them in the main

Reditecting pages based on logic
Newbie here, apologies in advance!

I am trying to use the header function to forward one of a

If a form submits back to same page do you need to use $get
IM trying to pass page number and year that was selected back to the same page.

i have this c

Disable html within defined tags
I have a mysql database that allows users to enter content with html, but I also want to have a tag

Must be a string? Huh, what? HELP?
with the following script, I get
Fatal error: Property name must be a string in /home/content/e/

Sending CC Info by email
I am a little bit less knowledgable in the security area as most developers and I know I have a lot

unserialize help, getting errors
hi all ,
I got a form with 6 fields (2 input and 4 select box), when the page loads one block is