SQL Injection


Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Did you know?Explore Trending and Topic pages for more stories like this.
Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.
Trending TodaySee what people are reading
No comments posted yet

Your Answer:

Login to answer
162 Like 9 Dislike
Previous forums Next forums
Other forums

Need a Timecode Class...
Not a Time Stamp, Time Code. Format is a bit different. HH:MM:SS:FF where FF is Frames. I dont re

Display certain image depending on time of year
Hi, I am new to these forums and would really appreciate some advice on a piece of coding I have don

PHP and MySQL on intranet?
Is it possible to use both these on an intranet network?

help with mysql_error()
Hi,

I am trying to insert data into a table, but I am not able to insert it. I wanted to see

PHP mail() returns true but doesn't work
First off I apologize if this is a newbie question, and I generally don't like asking questions that

Upload simple problem
Really confused!! I run once and it worked, but when i tried today...it didn't work

Which par

Displaying Site Logo/Icon on a Title tag
really need some help out here. I want to insert a Logo/Icon just like the one close to the "PH

INSERT for date range
Hi all

I have the following table

Code: [Select] `date` date
`day` int(2)
`

Auto install
Hi I have a directory lets say "apps" that I then have more folders ie "email",

Help with setcookie()
Merry Xmas to those on this foruum
Older guy here with some experience but not allot so please be

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



 
© indyaspeak.com. All Rights Reserved.
Play Free Quiz and Win Cash