SQL Injection


Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Did you know?Explore Trending and Topic pages for more stories like this.
Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.
Trending TodaySee what people are reading
No comments posted yet

Your Answer:

Login to answer
162 Like 9 Dislike
Previous forums Next forums
Other forums

Object Interfaces
EDIT: Never mind, I just updated to php 5.

Hey all,

I'm currently experimenting with p

Results from Db outputted twice
Hey guys.. for come reason my data is outputted twise shown in the image below and i cant figure out

PECL uploadprogress for php5.2
Hey, I just installed PHP5 via .htaccess on my 1and1 Shared Hosting Account.

How would I exac

Just wondering what you think about my site
I am new to phpfreaks i just seen this form and thought it would be cool to see what other thought a

read integers that returns a negative or prints the average
Im trying to finish this homework assignment by tommarow afternoon and I keep getting stuck.
Wr

shift numbers with paging
Hi

How would i be able to display 10 numbers 1 2 3 4 5 6 7 8 9 10
and when I click next

Header is not working in IE
Hi ! header function is not working in IE but it works in FF, Safari, Chrome. any help please. :

Tournament Brackets (Double Elimination)?
Is making a double elimination tournament style bracket system capable of being done in php?

does anyone know a php script to send mail using gmails/googles free smtp server
cause i heard u can do that but i dont know how

temporary objects
Until now i thought every temporary object in C++ is created as constant. I'm wondering why my compi

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



 
© indyaspeak.com. All Rights Reserved.
Play Free Quiz and Win Cash