note 49885 deleted from function.mysql-real-escape-string by aidan

Note Submitter: S. W. ---- For a "best practices" approach to handling user input, one should always include enforcement of input length limitations. This will avoid potential attacks based on *very* large values being inserted, some of which may not be foiled just by escaping a string. (Length limits imposed via your form may be bypassed by submitting from a page or tool created by the attacker.) As a cursory example: <?php $maxNameLen = 25; $limitedName = substr($_POST['username'],0,$maxNameLen); $safeUsername = mysql_real_escape_string($limitedName); ?> Note that you'll need to take care to truncate the correct (raw) value and not something that has already been processed. Otherwise, you're exposing the potential attack data to more potential points of failure, plus valid input may grow in length with escape processing and be incorrectly truncated.