SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

Undefined Variable: PHP_SELF, pls help
Hi,

Im a newbie on PHP / MySQL programming and Im running a script to search one field on my

Good Programming and Web Design Books
Hi,

I recived a pm today from a fellow phpfreaker regarding php books, i replied with the fo

LSB (PHP 5.3) problem with static value!
hello,

i'm having a problem. static::$text variable gets lost at some point. can someone plea

first few characters only
hi, does anyone know how to use PHP to take the first few words of a text and limit them? i have see

for some reason mysql query not working, not inserting, please check it out
This code is not inserting anything into my db, don't know why, the $_SESSION variable does contain

How to show next and prev records
Hi all,

Sorry if this is simple, i'm very new to php, well, any programming language actually

reating a background image
I am building a site in drupal and have a php form in it, due to certain annoyances with module buil

Socket programming
Hello all,

I have a PHP socket script. GPS trackers connect to this socket. IMEI verification

AutoChoosing a CSS file based on URL
Hey everyone,

I have a site that has multiple URLs and CSS files.

Based on the URL tha

Display certain image depending on time of year
Hi, I am new to these forums and would really appreciate some advice on a piece of coding I have don