SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

The repetition structure: the while statement not working
New programming student, have assignment as follows:
A restaurant has 4 lunch combos for custom

Relative path
I have a absolute path to an image - like so: C:/Program Files/Apache Software Foundation/Apache2.2/

a dificult string search
Hi I don't know a way around this. I want the user to input a password, but to make it a bit complca

Socket Server
In my following socket server, I am trying to listen to a connection through port 12345 in my web br

post to self
Trying to get my form to submit to itself. However I am also trying to use an image for my submit bu

Will an XHTML DOCTYPE interfere with my PHP if I'm not experienced enough?
I've read this article here: http://friendlybit.com/html/why-xhtml-is-a-bad-idea/

In a nutshe

query based on 2 conditions
I want to select if the doc_type is either s OR f but this doesn't work:

Code: [Select]$query

Question handling xml data
Hello,

I have sucessfull followed this tutorial
http://www.phpfreaks.com/tutorial/handlin

Help with search.php
Hello All

I need the search engine on a site I am building at the moment to display the searc

Grabbing Values From an Array for Posting
I have a grid array that I am using with a form that when it hits the currently named test.php it lo