preventing sql injections
| From: | Anders Thoresson | Date: | Wed, 18 Dec 2002 13:58:30 +0000 |
| Subject: | preventing sql injections | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-128710@lists.php.net to get a copy of this message | ||
Would this function do the trick?
<?php
// validate.php - functions that validates form input
function validate_string($unsafe_string) {
// create array containing bad words
$badwords = array(";","--","select","drop","insert","xp_","delete");
$goodwords = array(":","---","choose","leave","add"," ","remove");
// check for occurences of $badwords
for($i=0; $i<7; $i++) {
$unsafe_string = str_replace("$badwords[$i]", "$goodwords[$i]","$unsafe_string");
}
$unsafe_string = AddSlashes($unsafe_string);
$unsafe_string = trim($unsafe_string);
$safe_string = $unsafe_string;
Return $safe_string;
}
?>
Br,
Anders