note 93514 deleted from security.database.sql-injection by danbrown
| From: | danbrown@php.net | Date: | Mon, 14 Sep 2009 17:00:13 +0000 |
| Subject: | note 93514 deleted from security.database.sql-injection by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-160558@lists.php.net to get a copy of this message | ||
Note Submitter: markfiend at gmail dot com
----
Further to bendikt at armed dot nu below:
<?php
function sanitize(&$value, &$key) {
$value = str_replace(array("'", '"', '\\'),
'′', $value);
# replace single quote, double quote and backslash with HTML entity.
$value = preg_replace('/[\s\x00\x1a]+/', ' ', $value);
# replace any sequence of whitespace characters (spaces, tabs, line feeds, null chars, EOFs etc.)
with one space.
$value = trim($value);
# remove extra spaces
}
array_walk_recursive($_GET, sanitize);
array_walk_recursive($_POST, sanitize);
# recursive as superglobals can contain deeper array structure.
# rest of code...
?>