SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Your Answer:

Login to answer

Other forums

Problem with Sending Mail by PHP
hello all,
I m new to php, can u plz provide me the code to send mail by php having CAPTC

double and single quotes in text fields acting up... help please
Single quotes, when entered into a text field, create an sql error upon Submit. It seems to create t

Re-Order by ID Number
I have a cms set up for inputting an image, thumb, title, pdf, and eps. When input the database ass

how to populate a drop down box
Hi buddies!

PROCEDURE DOWNLOAD_REPORT_FORM (report_name varchar) is begin DOWNLO

Transport data between itab and textfield on ALV event
Hallo,

I have a ALV Grid ( cl_gui_alv_grid ) and I also have hotspot click event with a h

How to get exact 3 moths post date from today date using javascript
How to get exact 3 moths post date from today date using javascript
Please help

Problem with umlauts and UTF-8
Hello every1,

I'm creating my own little CMS at the moment and got some problems with the cha

Php WordPress help
I am writing the following code for making a plugin

<?php
header("Content-Type

PHP Form to Variable.
Hi! I have written a HTML-form code in DreamWeaver CS3 (in a PHP doc) and I really need it to work s

Run function every 5 mins ??
I have a function PostMessage()

How can I run it every 5 mins ??