note 92649 modified in function.mysql-real-escape-string by felipe

I use the following code in my database connection include file (which is of course called at the start of every page that needs to do some SQL)... Therefore, all POST and GET vars are automatically escaped before being used anywhere in SQL statements. <?php //This stops SQL Injection in POST vars foreach ($_POST as $key => $value) { $_POST[$key] = mysql_real_escape_string($value); } //This stops SQL Injection in GET vars foreach ($_GET as $key => $value) { $_GET[$key] = mysql_real_escape_string($value); } ?> --was-- I use the following code in my database connection include file (which is of course called at the start of every page that needs to do some SQL)... Therefore, all POST and GET vars are automatically escaped before being used anywhere in SQL statements. //This stops SQL Injection in POST vars foreach ($_POST as $key => $value) { $_POST[$key] = mysql_real_escape_string($value); } //This stops SQL Injection in GET vars foreach ($_GET as $key => $value) { $_GET[$key] = mysql_real_escape_string($value); } http://php.net/manual/en/function.mysql-real-escape-string.php