note 70104 added to function.mysql-real-escape-string

To aide in the simplicity of things, I try and validate the information before it is even queried to the MySQL server. For example. With usernames and passwords, I check for spaces. And ; signs. If either of these are in there, then the login request is ignored, since I do not allow either during registration. So a simple attack like: 1 or 1=1 Isn't even sent. Instead a "Please check username / password and try again" message is displayed. I display the same message when the query is ignored as I do when an invalid login is parsed. As to not "challenge" the attacker. Make them think simply it was an invalide username/password, rather than a big deal like die("Hacking attempt!!!"); You could very easily implement logging to keep track of malicious IP's and what-not as well. ---- Server IP: 216.194.113.175 Probable Submitter: 69.165.76.246 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/70104 Del: integrated -- https://master.php.net/note/delete/70104/integrated Del: useless -- https://master.php.net/note/delete/70104/useless Del: bad code -- https://master.php.net/note/delete/70104/bad+code Del: spam -- https://master.php.net/note/delete/70104/spam Del: non-english -- https://master.php.net/note/delete/70104/non-english Del: in docs -- https://master.php.net/note/delete/70104/in+docs Del: other reasons-- https://master.php.net/note/delete/70104 Reject -- https://master.php.net/note/reject/70104 Search -- https://master.php.net/manage/user-notes.php