note 102794 deleted from security.database.sql-injection by danbrown
| From: | danbrown@php.net | Date: | Mon, 07 Mar 2011 12:32:45 +0000 |
| Subject: | note 102794 deleted from security.database.sql-injection by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-177614@lists.php.net to get a copy of this message | ||
Note Submitter: info at foziasoft dot com
----
function secure($array) {
$newArray = array();
foreach($array as $key => $value) {
if (is_array($value)) {
$newArray[$key] = secure($value);
}
else {
$newArray[$key] = htmlspecialchars(stripslashes($value));
$newArray[$key] = str_ireplace(
array (
'*',
'#',
'SELECT ',
'UPDATE ',
'DELETE ',
'INSERT ',
'DROP ',
'--',
'1=1',
'INTO',
'VALUES',
'FROM',
'LEFT',
'JOIN',
'WHERE',
'LIMIT',
'ORDER BY',
'AND',
'OR ',
'DESC',
'ASC',
'ON '
),
'BadChar',
$newArray[$key]
);
$newArray[$key] = mysql_real_escape_string($newArray[$key]);
}
}
return $newArray;
}
if($_REQUEST){
$_GET = secure($_GET);
$_POST = secure($_POST);
}