note 99878 modified in function.mysql-real-escape-string by danbrown

Also don't forget to escape $_COOKIE array before quering the database. In firefox you can edit cookies and insert and inject harmful sql queries. <?php foreach ($_COOKIE as $key => $value) { if(get_magic_quotes_gpc()) $_COOKIE[$key]=stripslashes($value); $_COOKIE[$key] = mysql_real_escape_string($value); } ?> --was-- Also don't forget to escape $_COOKIE array before quering the database. In firefox you can edit cookies and insert and inject harmful sql queries. A user before posted a way to make safe all posts and gets. I am doing this also with cookies: foreach ($_POST as $key => $value) { if(get_magic_quotes_gpc()) $_POST[$key]=stripslashes($value); $_POST[$key] = mysql_real_escape_string($value); } foreach ($_GET as $key => $value) { if(get_magic_quotes_gpc()) $_GET[$key]=stripslashes($value); $_GET[$key] = mysql_real_escape_string($value); } foreach ($_COOKIE as $key => $value) { if(get_magic_quotes_gpc()) $_COOKIE[$key]=stripslashes($value); $_COOKIE[$key] = mysql_real_escape_string($value); } http://php.net/manual/en/function.mysql-real-escape-string.php