Re: Relatively simple PHP function to block sql injection

""Jacob Kruger"" <jacobk@mailzone.co.za> schrieb im Newsbeitrag news:000301ca15cf$b71e72c0$6401a8c0@spaceque1d2a04... > Ok, now got this from w3schools.com: > > function check_input($value) > { > // Stripslashes > if (get_magic_quotes_gpc()) > { > $value = stripslashes($value); > } > // Quote if not a number > if (!is_numeric($value)) > { > $value = "'" . mysql_real_escape_string($value) . "'"; > } > return $value; > } > > Will test it a bit, and see how it goes, but basically makes sense. A better name for this function would be e.g. ensure_escaped_string. Additionally, the function assumes that you pass it an already quoted value if get_magic_quotes_gpc() == true. I think it is better to separate the unquoting and factor it out into a separate function, unquoting all superglobal arrays that can contain quoted values ($_POST, $_GET, $_COOKIE). This is what I do in my scripts - you can be sure at any place you use the function that the value passed is definitely unquoted. Klaus Triendl