SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

In my attempts to protect my database from mySQL injection I have created another problem for myself....

Currently all user inputted strings go through this function;

Code: function cleanQuery($string)
{
if(get_magic_quotes_gpc())
{
$string = stripslashes($string);
}
$string = mysql_real_escape_string($string);

$string = htmlentities($string);

return $string;
}
In the most, its great HOWEVER... there are three fields which I would like the user to be able to enter spaces in. An "About me" field for example, if it is run through the above function the new lines are replaced with a 'r' which i assume is "created" by the mysql_real_escape.

Question;

1) Should i run the function on every user variable?
2) Is there a safe "fix" or something alternative which i can run on the three fields which may require line breaks.

thanks.

Other php-forum

Strange Oracle Query problem
Ok So I have this PHP class that talks to a Javascript class that basically creates a table of infor

Quick fix: Conditional statement with an array
Hi, I'm getting the temperature value off of the Environment Canada website along with the icon file

PHP not creating file.
Its supposed to create a .ini file in the /scriptfiles/users/ with the name they entered into the fi

Need help making login verification cleaner...
I use the below to verify user login. I first check the cookie for the id, ip and a unique id. If it

2 things: enter doesn't work in IE & empty form
i have this search form that works well except for 2 things.

1) on IE when i hit enter instea

Simple AND question
Hello,

I've got following code:

Code: if(strpos($row[13],"http://")

please help me... my password gets encrypted but not able to get in database
hai guys,
please help me... in the following function my password gets encrypted but no

Different actions for different parts of a string
<?php
function dosomething($string, $else = '') {
if (empty($else))
$string

PHP5 - Verifying a secure mail is secure
I need to send an e-mail from a form to a external department and because it contains personal custo

PHP and MySQL Question/Help
I have a MySQL db with all my servers and all their details like server name, IP, OS, RAM etc etc 26