SQL Injection


Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Did you know?Explore Trending and Topic pages for more stories like this.
Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.
No comments posted yet

Your Answer:

Login to answer
162 Like 9 Dislike
Previous forums Next forums
Other forums

Using Curl_multi for processing multiple URLs
Hi,

I am at a loss as to how to implement this. I would like to be able to automatically assi

Recording popularity by day, week.. all time?
Hey everyone, I'm creating a site designed around users uploading music. How can I implement a syste

Firefox displaying PHP source code??
Currently testing a site thats almost built, am going to be including php on a sidebar on all pages

Display error above the login forum help!
Hi guys. just so you know im not asking for someone to do this for me I just need to be pointed in t

email form (cannot find the problem)
Hello there. I've been having trouble with an email form. Can't find the problem really. I've tested

Somebody hacked into my site and changed coding >>> URGENT HELP NEEDED <<<
I am not that much into programming , but somebody is hacking to my site and injecting some kind of

some query on multilingual website
Hi all,

Which is the simplest and easiest method to make a website multilingual,
is it put

how to transport the Query and insfoset
Hi

I have created the query using SQ01........
How to created T-code for query..

problem with php mysql query
Hi guy's...

I'm totally lost here..because don't have any idea how to make a query for grab r

fopen() security
As i understood the usage of fopen() for it to function correctly the Dir you write to has to be rw

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash