SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

The page should be expire when cilck back button
hi,
i'm new to php world.
i create user registration page.
when i submit it,data goes to my

JSON SORT WITH PHP
I have two products that I want to sort by say "Id:17, value: xxx" using php
The page w

Removing Title From database problem
Hi again ! i am having an issue with updating database. When i update any price of a title it remove

phpMailer will not connect using SMTP
I am trying to use phpMailer with smtp:

Code: [Select]$mailer = new PHPMailer();
$mailer-&

Session
I am having a little trouble with a session. Not sure if it is my browser or what. I know I do not

FROM_UNIXTIME($phpdate);
Hello,

I tried to use this :

$date = FROM_UNIXTIME($phpdate);

ANd I was t

If a record matches an existing record do nothing
So I don't know if I should put this here or in mysql, but what my script is for is for people to ad

Add User script "Could not execute query"
This should be an easy script but I can't get it to run. Can someone please help me?

<

rename the file
File.txt

Code: ***DOCUMENT***
..DN:
000044255
..CB:
..SN:
..PY:
2009
..E

problem when runing a funciton
I am trying to connect to database using a funciton in a functions.php

<?php
funct