SQL Injection


Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Did you know?Explore Trending and Topic pages for more stories like this.
Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.
Trending TodaySee what people are reading
No comments posted yet

Your Answer:

Login to answer
162 Like 9 Dislike
Previous forums Next forums
Other forums

natcasesort works on one server but not on another
Hi

I have a problem that I was hoping that someone can help me with.

I'm trying to use

Xacute search within SQL results
I have a query that is pulling data, and I want to return a specific value from the results of that

How to display objects in a row
I have 7 codes that i want to display in a row one next to another.
The first is {$ads->ad

Different payment methods with different cross company requirements in F110
We are implementing SAP in a company in the shipping industry. They have the following requirement:<

Working with popups and such in a class
I've recently started building my applications completely enclosed in classes. I like the fact that

Cursor statement failed with errors
Following statement failed with the errors.

cursor proj_cursor1 is (select projectID from

Remove Rows From Database ad
Hi All,

I have this:

Code: [Select]<?php
session_start();
include('../com

is_dir() problem
Hello,

I'm buidling a php scripts that dynamically get's subfolders from a specific folder.

Extract specific information from a PHP Multidimensional Array
Howdy! I've racked my brain over this for 24 hours now. I think it's time I asked for help. I'm lear

DB2 for z/OS, LUW, iSeries
Hello, In this forum a lot of threads related to other members of the DB2 family than DB2 for z/OS

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



 
© indyaspeak.com. All Rights Reserved.
Play Free Quiz and Win Cash