Re: Input field

Ronald Wiplinger wrote:

I added just into a input field" 19" enclosure which was displayed from the database as: 19\" enclosure That gives me some questions: 1. where the protecting slash comes from?

Probably magic_quotes_gpc

2. how can I get it away when I want to display that field?

1) Turn off magic_quotes_gpc in a htaccess file: php_flag magic_quotes_gpc 0 2) When you insert the data, use mysql_real_escape_string 3) When you display the data, use htmlspecialchars or htmlentities

3. The slash is not to see in phpmyadmin, why not?

It probably has code to pick up magic_quotes_gpc and work around it.

1. what else do I need to take care with input fields and if they are going to a mysql database?

Use mysql_real_escape_string

2. can I use a function for that kind of protection for each field - or even better just flag it in php to protect?

There is no flag, you need to use escape_string for each field.

3. is HTTP_REFERER & session-id enough to make sure that no variables can be injected?

No way. Never ever ever ever trust user data (did I mention never ever?). Authenticated users can do just as much damage as an unauthenticated user. Read http://phpsec.org/projects/guide/ before you touch any more code. -- Postgresql & php tutorials http://www.designmagick.com/