SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

date("now") prints out wrong date ?
Hi Guys
Anyone know why and how I can fix it ?

listcube issue
Hi
I have a virtual cube ZREMOTE. I use Tcode "listcube" to retrieve contents. I use of the

Bandwidth monitoring?
Hi guys,

I need a little information I have written a php app and I occurred to that I need

Help on query replacing the date
Hi Pals,

i want to replace the current date in a column to some value say C or D or any n

Class not found error
I am getting Class 'index' not found in Eval function:

//write config

$pat

PHP search multiple input field box help
I am having a problem with my search script. At current it will simply search by a selected date whi

Help with forum quoting?
Hi im working on a forum and I have alomost finished it but i want a user quote system like twitter

Help with lottery style system?
I'm working on a currency system for forums and it is going to have a type of lottery system built i

Images in email problem
I found this script for sending emails, it works but if the email has <img src="image.jp

Displaying image pathname instead of image
Hello

Im trying to upload and then display images from a mysql database - Its only basic and