SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

Taxonomy? Classification? Categorisation?
Not sure if there is a way around this classification problem
I have a supplier who produces

Not showing whole name with mail () script
I sent up a simple mail form with the PHP mail() script. One problem is when it sends an email with

I need an iframe that calls up a different page according to the date
hi

I don't know any php (only html) and I urgently need to do the following:

I need a

To add a field on the screen XK02.
Hi All,

How to add an additional field in the vendor change control screen XK02.
The

Need some ideas as to how to go about sorting this array...
Here's how the array's are created..

Code: <?php
while ($x = readdir($dp)) {

newbie question about multiple queries
hi everyone,
I'm sorry to ask such a basic question, but I'm young and trying to learn php on my

License Issue - service type user
Hi,

I would like to understand the following issue regarding sap license.
I wish to

Converting RGB values to HEX
Code: <?PHP

$file_handle = fopen("colors/rgb.csv", "r");

wh

change text color with a jQuery code
Hihow can I change the text in a asp:TextBox to a different color when I start typing using jQuery?I

Best way to check for end of a record and send it back to the first record
I'm hoping someone can help me out and explain the best way to accomplish this.

What I'm doin