Re: checking info before putting into database

<snip> > $f_name = trim($f_name); // I use this to remove any whitespace > $f_name = addslashes($f_name); // I use this to protext my self > from -'s- situations > $f_name = strip_tags($f_name); // I use this to remove any PHP > and HTML tags <snip> > Also is there any quicker way of doing it that anyone has developed > rather than writing the above for each variable. How about a function : function checkInfo($field) { $field = addslashes(strip_tags(trim($field))); Return $field; } $f_name = checkInfo($f_name); Also, check out this article : http://phpbuilder.com/columns/sporty20001102.php3 Regards, Philip --.sig [ Want to write Good code? First, write Bad code. ] On Fri, 15 Dec 2000, Scott Mebberson wrote: > Hi Guys, > > Just need peoples thoughts on the following when putting information into a > database (the information is from text put into form feilds by users), I > know I have to run checks for security and integrity issues but I am trying > to work out what checks I should run as standard. > > At the moment I am running these checks on all vars that are going into the > database. > > $f_name = trim($f_name); // I use this to remove any whitespace > $f_name = addslashes($f_name); // I use this to protext my self from -'s- > situations > $f_name = strip_tags($f_name); // I use this to remove any PHP and HTML tags > > I use checks above as standard checks that I do to make sure things are > safer. Also is there any quicker way of doing it that anyone has developed > rather than writing the above for each variable. Maybe creating an array and > looping through the array, while doing that running these standard checks on > the variables. > > Thanks for any info, thoughts you can provide. > > Scott. > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net >