SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

Multiple forms on the same page (safari)
Hello everyone,

I have 3 forms on the same page, that opens in a new window and submits to a

how to configure ADS in ABAP instance
Hi All,

I am working on r/3 4.7 ABAP system.Can we configure ADS(adobe document services)

Remove values in array2 from array1
I have two arrays.

Array 1 is where the array key holds various different numbers. For exampl

PHP Code reffering to database, doing something wrong.. pls help
Well i am quite new with PHP
and for school we have to make a PHP script which reffers to a Data

having a small php error tha deals with the 'foreach'
Last night i was working on a script for a cart and it seemed to working good, until this morning. F

connect() succeeds but accept() does not?
Please help me with this problem. I'm working on a time-sensitive project where I'm using TCP socket

progress bar...need expert opinion of experienced webmaster
Hey guys, quick question:

I want to display a progress bar when I upload files, but I am not

Warning: Cannot modify header information - headers already sent by (output sta
Warning: Cannot modify header information - headers already sent by (output started at /home/praylif

first id from db not showing
I have a php script which displays the content of a mysql table as a html table with sorting, delete

Simple AND question
Hello,

I've got following code:

Code: if(strpos($row[13],"http://")