note 58870 added to function.mysql-real-escape-string

this code will 99% protect your system + html injection, but you will need to use $_POST['var'] AND not $var... <? # Http://onev.org # Serii@onev.org # if you usin this code place link to onev.org in your site $PROTECT = array ( "& " => "&#38;", "# " => "&#35;", "!" => "&#33;", '"' => "&#34;", "$" => "&#36;", "%" => "&#37;", "'" => "&#39;", "(" => "&#40;", ")" => "&#41;", "*" => "&#42;", "/" => "&#47", ">" => "&#60;", "<" => "&#62;", ); function VAR_DECODE($_VAR) { global $PROTECT; if (get_magic_quotes_gpc()) { $VAR = stripslashes($_VAR); } if (!is_numeric($VAR)) { while (list ($key, $val) = each ($PROTECT)) { $VAR = str_replace($key, $val, $VAR); } } return $VAR; } unction VAR_ENCODE($VAR) { global $PROTECT; if (!is_numeric($VAR)) { while (list ($key, $val) = each ($PROTECT)) { $VAR = str_replace($val, $key, $VAR); } } return $VAR; } while (list ($key, $val) = each ($_POST)) { $_POST[$key] = VAR_DECODE($val); } while (list ($key2, $val2) = each ($_GET)) { $_GET[$key2] = VAR_DECODE($val2); } while (list ($key3, $val3) = each ($_COOKIE)) { $_COOKIE[$key3] = VAR_DECODE($val3); } while (list ($key4, $val4) = each ($_REQUEST)) { $_REQUEST[$key4] = VAR_DECODE($val4); } ?> use var encode if you need the surce var... ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+58870 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+58870&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+58870&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+58870&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+58870&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+58870&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+58870&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+58870&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+58870&report=yes Search -- http://master.php.net/manage/user-notes.php