SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

shift numbers with paging
Hi

How would i be able to display 10 numbers 1 2 3 4 5 6 7 8 9 10
and when I click next

Form Help
Here is the form:

Line number On/Off | Expand/Contract<? include("../include/sess

Help! refer to a friend script with captcha code
Hi guys, I am posting on here in desperate need for some help with an ongoing search I have been doi

Just a white page
Okay so, my website, when I click SignUp on it it takes me to /join.php but its a complete white pag

Which PHP-Editor do you think is the best?
Hi everyone,
Myself Brian Anderson. For the last 2 years i have been working a

passthru() help
Hi everyone,
I'm new to the forum and to PHP. I have some pretty good experience writing shell sc

Looking for help reading a .txt or .ini file and outputting the info.
I have a file called Info.ini and It has the following info:
Code: [General]
Online=0
I wou

str_replace help
Hey there,

I'm a PHP newb, I'm having troubles with the str_replace function. I want to clean

How can I uploading Transactional Data from Legacy to New SAP system
Hell Gurus,

I am overwhelmed with questions on how to migrate huge volume of Sales Orders

Impact of movement type 412 E on MAP
Hi

Usage of movement type 412 E is causing huge change in MAP .

Is there any r