Re: is it safe to stripslashes() on all form variables?

Previous post does not address how to avoid making this kind of security hole. Anyway, if anyone want to avoid creating security hole like this. Do not stripslashes() added by magic_quote. If you use stripslashes(), use addslashes() again. If you do not use magic_quote, use addslashes() before feeding to database, shell or whatever that might be dangerous w/o slashes. Disabling magic quote will reduce amount of code and increase performance a little, unless application is very small. Without magic_quote, script does not have to get rid of slashes to use value from browser and add slashes again before feeding to database. Code would be cleaner and easier to read also. (Especially for programmers are not used to PHP.) Hope this helps someone. -- Yasuo Ohgaki ""Yasuo Ohgaki"" <yohgaki@hotmail.com> wrote in message news:9bg8tl$rvl$1@toye.p.sourceforge.net... > If you strip slashes, it will make a security hole. > > For example, > > SELECT * FROM tablename WHERE name = '$name'; > what if $name is > \'garbage\';DROP TABLE tablename;SELECT \'something > > After stripslashes($name) > SELECT * FROM table WHERE name = 'garbage';DROP TABLE tablename;SELECT > 'something'; > > Regards, > -- > Yasuo Ohgaki > > > ""Noah Spitzer-Williams"" <noahsw@cyberdude.com> wrote in message > news:9bf7ec$m1m$1@toye.p.sourceforge.net... > > would there be any problems caused if i used the stripslashes() function on > > all posted variables from a form to eliminate sql query errors? > > > > - Noah > > > > > > > > -- > > PHP General Mailing List (http://www.php.net/) > > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > > For additional commands, e-mail: php-general-help@lists.php.net > > To contact the list administrators, e-mail: php-list-admin@lists.php.net > > > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net >