checking info before putting into database
| From: | Scott Mebberson | Date: | Fri, 15 Dec 2000 01:58:15 +0000 |
| Subject: | checking info before putting into database | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-30435@lists.php.net to get a copy of this message | ||
Hi Guys,
Just need peoples thoughts on the following when putting information into a
database (the information is from text put into form feilds by users), I
know I have to run checks for security and integrity issues but I am trying
to work out what checks I should run as standard.
At the moment I am running these checks on all vars that are going into the
database.
$f_name = trim($f_name); // I use this to remove any whitespace
$f_name = addslashes($f_name); // I use this to protext my self from -'s-
situations
$f_name = strip_tags($f_name); // I use this to remove any PHP and HTML tags
I use checks above as standard checks that I do to make sure things are
safer. Also is there any quicker way of doing it that anyone has developed
rather than writing the above for each variable. Maybe creating an array and
looping through the array, while doing that running these standard checks on
the variables.
Thanks for any info, thoughts you can provide.
Scott.