note 92744 deleted from security.database.sql-injection by sobak

Note Submitter: fyrye ---- Another way to prevent SQL injections as opposed to binary, is to use URL Encoding or Hex Encoding. I haven't seen a complete example of stopping SQL Injections, most refer to use the mysql_real_escape_string function or param statements. Several examples at http://en.wikipedia.org/wiki/SQL_injection Which will stop \x00, \n, \r, \, ', " and \x1a based attacks. Alot depends on your SQL query structure, though vector level attacks are still viable. Other than that build your own regex replacement to protect specific queries that could alter or compromise your database/results for specific sections of your processing pages. Also use unique table and field names. Not just putting _ infront of them... Example, don't store User/s or Customer/s information in a table named the same. And NEVER use the same form field names for database field names.