Re: Sanitizing potential MySQL strings with no database connection
| From: | Dotan Cohen | Date: | Wed, 21 Oct 2009 15:11:29 +0000 |
| Subject: | Re: Sanitizing potential MySQL strings with no database connection | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-299160@lists.php.net to get a copy of this message | ||
> Thinking a little deeper here, you say you are concerned about the character
> type, yet you say that it is all assumed UTF-8. Is everything going to be UTF-8
> or something else?
>
> If it is all going to be UTF-8, then the addcslashes() variation above will work.
>
It _should_ all be UTF-8 but I suppose that it is possible for someone
to spoof a non-UTF-8 POST request. I do not want to take the
development of a secure function into my own hands.
--
Dotan Cohen
http://what-is-what.com
http://gibberish.co.il