Sanitizing mysql inserts of user data
| From: | Dotan Cohen | Date: | Sun, 16 Aug 2009 18:42:57 +0000 |
| Subject: | Sanitizing mysql inserts of user data | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-296848@lists.php.net to get a copy of this message | ||
I am sanitizing user-entered data before storing in mysql with this function:
function clean_mysql ($dirty) {
$dirty=trim($dirty);
$dirty=str_replace ("--", "", $dirty);
$dirty=str_replace (";", "", $dirty);
$clean=mysql_real_escape_string($dirty);
return $clean;
}
Is this good enough to prevent SQL injection attacks? Should I add
anything else? Thanks!
Dotan Cohen