Re: Preventing SQL Injection/ Cross Site Scripting
| From: | Richard Lynch | Date: | Sun, 22 Apr 2007 05:02:10 +0000 |
| Subject: | Re: Preventing SQL Injection/ Cross Site Scripting | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-253469@lists.php.net to get a copy of this message | ||
On Fri, April 20, 2007 8:08 pm, Dotan Cohen wrote:
> I've got a comments form that I'd like to harden against SQL Injection
> / XSS attacks. The data is stored in UTF-8 in a mysql database. I
> currently parse the data as such:
> After seeing this:
> http://ha.ckers.org/xss.html
> and another similar one for SQL injection, I'm worried that my filters
> are not enough. What do the pro php programers out there use?
http://phpsec.org
For MySQL:
http://mysql_real_escape_string
--
Some people have a "gift" link here.
Know what I want?
I want you to buy a CD from some indie artist.
http://cdbaby.com/browse/from/lynch
Yeah, I get a buck. So?