note 84282 deleted from function.mysql-query by thesaur

Note Submitter: Ryan Reason: 2 ---- If you are using a variable loaded with user defined data in an SQL query you have to protect yourself from SQL injection. Here is a simple function to keep sql queries safe, run the user defined data though this function before using it in a query to sanitize the input stopping SQL injection attempts. Designed to work reguardless of PHP version. <?php function sql_safe($string){ if(get_magic_quotes_gpc()) { $string = stripslashes($string); } $badWords = "(delete)|(update)|(union)|(insert)|(drop)|(http)|(--)"; $string = eregi_replace($badWords, "", $string); if (phpversion() >= '4.3.0') { $string = mysql_real_escape_string($string); } else { $string = mysql_escape_string($string); } return $string; } ?>