note 49885 added to function.mysql-real-escape-string

For a "best practices" approach to handling user input, one should always include enforcement of input length limitations. This will avoid potential attacks based on *very* large values being inserted, some of which may not be foiled just by escaping a string. (Length limits imposed via your form may be bypassed by submitting from a page or tool created by the attacker.) As a cursory example: <?php $maxNameLen = 25; $limitedName = substr($_POST['username'],0,$maxNameLen); $safeUsername = mysql_real_escape_string($limitedName); ?> Note that you'll need to take care to truncate the correct (raw) value and not something that has already been processed. Otherwise, you're exposing the potential attack data to more potential points of failure, plus valid input may grow in length with escape processing and be incorrectly truncated. ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+49885 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+49885&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+49885&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+49885&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+49885&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+49885&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+49885&report=yes Search -- http://master.php.net/manage/user-notes.php