SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

MS are the best!!!
Visit http://www.microsoft.com/australia/windows/default.aspx?h=watch-a-demo and click the massive '

JSON SORT WITH PHP
I have two products that I want to sort by say "Id:17, value: xxx" using php
The page w

Question about ShowWindow()
Hello....

I'm struggling with sumpin, and I hope y'all can help.

I've got a CFormView

Text to picture Generator
Hello, i have found this script and it works really good^^ But i have one problem, i would like to c

ob_ dynamic content
i was wondering about the potential to use ob to create a <div then remove it when the page

Problems generating word documents on server side for security reasons
I have a problem with word documentation generation when generating a word document (docx) with PHP.

Sorting JTable on more than just the values listed in the columns
I have a collection of objects that store (among other things) two integer values. I only want to di

default SAP userid
hi,, I just like to know if it is ok to use the default SAP user id (SAP*)?

Could Someone Please Debug This?
I was wondering if someone could debug this script for me. I realize it's not the tidest script (and

Mouseover to edit (Ajax)
hi friends, can anyone help with the code behind to get this application working, please in VB (new