SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

LIMIT $start, 10... how to pass last value queried into next page with GET??
Ok I know how to display the first or last 10 results of a query...

$result = mysql_query(&q

Struct/union and scope problem!
HI all , I have
Code: in header.h typedef struct Node Link; /* ---------

generating random codes
Hi guys n gals,

I have a requirement to generate 250,000 unique codes...

These codes a

Using cURL to PUT
Can somebody help with the correct php code to make a cURL PUT request. Here is a sample of code bel

Saving PHP output as a file
I wondered if anyone knows how to save the rendered output of a PHP script as a file?

I have

Warning: mysql_num_rows() expects parameter 1
When i add quote at the end of this link
example:http://localhost/articlemania/category.php?cid=3

animation progress while uploading files?
Hello, i have some website form to upload few files to server. i want to put some gif animation whi

Displaying Site Logo/Icon on a Title tag
really need some help out here. I want to insert a Logo/Icon just like the one close to the "PH

MySQL Primary key gap
Alright, so I have a table with 26 entries in it (id, filename, caption) for my image randomiser (ht

frames get header location..
i have two frames, one top, one bottom. how do i do a form on the bottom frame that gives me the ur