note 92649 deleted from function.mysql-real-escape-string by philip
| From: | philip@php.net | Date: | Fri, 04 Sep 2015 20:02:17 +0000 |
| Subject: | note 92649 deleted from function.mysql-real-escape-string by philip | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-203672@lists.php.net to get a copy of this message | ||
Note Submitter: Anonymous
----
I use the following code in my database connection include file (which is of course called at the
start of every page that needs to do some SQL)...
Therefore, all POST and GET vars are automatically escaped before being used anywhere in SQL
statements.
<?php
//This stops SQL Injection in POST vars
foreach ($_POST as $key => $value) {
$_POST[$key] = mysql_real_escape_string($value);
}
//This stops SQL Injection in GET vars
foreach ($_GET as $key => $value) {
$_GET[$key] = mysql_real_escape_string($value);
}
?>