note 84282 added to function.mysql-query

If you are using a variable loaded with user defined data in an SQL query you have to protect yourself from SQL injection. Here is a simple function to keep sql queries safe, run the user defined data though this function before using it in a query to sanitize the input stopping SQL injection attempts. Designed to work reguardless of PHP version. <?php function sql_safe($string){ if(get_magic_quotes_gpc()) { $string = stripslashes($string); } $badWords = "(delete)|(update)|(union)|(insert)|(drop)|(http)|(--)"; $string = eregi_replace($badWords, "", $string); if (phpversion() >= '4.3.0') { $string = mysql_real_escape_string($string); } else { $string = mysql_escape_string($string); } return $string; } ?> ---- Server IP: 69.147.83.197 Probable Submitter: 71.221.216.219 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-query.php Edit -- https://master.php.net/note/edit/84282 Del: integrated -- https://master.php.net/note/delete/84282/integrated Del: useless -- https://master.php.net/note/delete/84282/useless Del: bad code -- https://master.php.net/note/delete/84282/bad+code Del: spam -- https://master.php.net/note/delete/84282/spam Del: non-english -- https://master.php.net/note/delete/84282/non-english Del: in docs -- https://master.php.net/note/delete/84282/in+docs Del: other reasons-- https://master.php.net/note/delete/84282 Reject -- https://master.php.net/note/reject/84282 Search -- https://master.php.net/manage/user-notes.php