SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

a multi dimensional array with for each
hi, I have been asked to write an array, I have Zone 2,3,4,5,6,7,8 each zone has 3 sections of weigh

Ajax Error since Upgrading to 3.5
Ever since upgrading my site to .NET 3.5 (I needed LINQ), I've been getting this annoying error on o

Wierd if else problem
Hi guys,

this probably aint wierd for you, but it seems like php is playin up to me. may b i

Recognising Revenue daily
Hello.
Has anyone come across daily recognition of deferred income?
We want to implement R

PHP url branch??
Functionally, using PHP, I'm doing a test of login input submitted by a user via an html form in a f

Undefined Variable: PHP_SELF, pls help
Hi,

Im a newbie on PHP / MySQL programming and Im running a script to search one field on my

ALV List Display to point to another report on Double Click
Hi,

I want my ALV List Display to point to another report on Double Click on its line ite

convert pps to wsf with php'how?
hi
i want to convert with php
PowerPoint file to swf file(flash)
how please?
thank!!!

calendar dates and hours compare problem
i have a calendar in wordpress, everything works great except that i can make 2 meetings at the same

have trouble in a if condition
The if below is working ok, it check when indexes, name, zipcode and state are empty.
Code: &