Re: sanitizing/security
| From: | Jed Smith | Date: | Sun, 19 Dec 2004 04:30:45 +0000 |
| Subject: | Re: sanitizing/security | ||
| References: | 1 | Groups: | php.general php.general |
| Request: | Send a blank email to php-general+get-204672@lists.php.net to get a copy of this message | ||
mysql_escape_string() is what you're looking for.
Jed
Sebastian wrote:
just a question, what is the best way to sanitize your scripts when you're
using $_GET or $_REQUEST in a query?
eg, i usually just do:
if(is_numeric($_REQUEST['id']))
{
mysql_query("SELECT id FROM table WHERE
id=".intval($_REQUEST['id'])."");
}
what about when the GET is text? just use htmlspecialchars?
just looking for some advice to help keep my apps secure.
cheers
--
_
(_)___ Jed Smith, Code Monkey
| / __| jed@jed.bz | jed@php.net
| \__ \ +1 541 606-4145
_/ |___/ Signed mail preferred (PGP 0x703F9124)
|__/ http://personal.jed.bz/keys/jedsmith.asc