SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

Anti Spam Code
Ok where do i start? Probably by telling you I have very little working knowledge of PHP and that I

CODE NOT WORKING
Code: [Select]<?php
//include shared codes

include '../lib/common.php';
include

I face problems to extract data from one table and insert it in another one
Hi,

For modifications, I have to extract data from one table and insert it in another one

rand() function
just a general question guys a girls, is the rand() function 100% random or is it based on time?

Phase Error I can't seem to find :(`
Hey guys, I can seem to find my phase error on this. I am getting this error

[error]
Pars

Help, Base64 encoding url and decoding server side.
Hello everyone, i have a website with videos and games and also provide an embed code which people c

asp authentication problem
Hello all, I want to use the asp authentication (from asp.net configuration) in my web site. there

question about stripslashes and real_escape_string
im cleaning up an old app that I wrote fixing some of the vulernabilities from attacks.

I hav

Day of week
I am using PHP version 5.0.5
I have a varaible ($DATE (date format yyyy-mm-dd)) that is being inc

mysql_real_escape_string making variable equal nothing
i post a form and i post the variable:
Code: $var = $_POST[variable];then i echo $var its what i