RE: [PHP] Sanitizing mysql inserts of user data
| From: | Caner Bulut | Date: | Sun, 16 Aug 2009 18:50:37 +0000 |
| Subject: | RE: [PHP] Sanitizing mysql inserts of user data | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-296851@lists.php.net to get a copy of this message | ||
Hi Dotan,
You can use htmlentities(), htmlspecialchars() and strip_tags() functions
when you show your saved data on your web pages. mysql_real_escape_string
function saved data into mysql DB with a secure way. But when you try to
show data you still have to control it.
Thanks.
Caner.
-----Original Message-----
From: Dotan Cohen [mailto:dotancohen@gmail.com]
Sent: Sunday, August 16, 2009 9:43 PM
To: php-general.
Subject: [PHP] Sanitizing mysql inserts of user data
I am sanitizing user-entered data before storing in mysql with this
function:
function clean_mysql ($dirty) {
$dirty=trim($dirty);
$dirty=str_replace ("--", "", $dirty);
$dirty=str_replace (";", "", $dirty);
$clean=mysql_real_escape_string($dirty);
return $clean;
}
Is this good enough to prevent SQL injection attacks? Should I add
anything else? Thanks!
Dotan Cohen
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php