Linked Questions
31 questions linked to/from PHP: Is mysql_real_escape_string sufficient for cleaning user input?
1287
votes
17
answers
707k
views
How can I sanitize user input with PHP?
Is there a catchall function somewhere that works well for sanitizing user input for SQL injection and XSS attacks, while still allowing certain types of HTML tags?
- 23.7k
795
votes
4
answers
326k
views
SQL injection that gets around mysql_real_escape_string()
Is there an SQL injection possibility even when using mysql_real_escape_string() function?
Consider this sample situation. SQL is constructed in PHP like this:
$login = mysql_real_escape_string(...
- 84.2k
18
votes
4
answers
3k
views
Am I safe from a MySQL injection? [duplicate]
Is the following good enough to avoid a SQL injection?
mysql_real_escape_string(htmlentities (urlencode($_POST['postmessage'])));
- 7,867
6
votes
8
answers
8k
views
Login code sample which has been hacked via SQL Injection, although mysql_real_escape_string...
I use CodeIgniter, and having trouble with hacking. Is it possible to make SQL Injection to the login code below:
function process_login()
{
$username = mysql_real_escape_string($this->...
- 6,104
6
votes
6
answers
6k
views
Preventing SQL injection using ONLY php
The think is that i have a complete working website with many calls to the MySQL server and doing some research on this site i saw that making my querys in this form:
$query = sprintf("SELECT * FROM ...
- 15.6k
4
votes
5
answers
21k
views
A better SQL string sanitization function [duplicate]
I am currently using below function to sanitize my $_POST and $_GET against SQL injection. Unfortunately, I cannot post code through it, for example: "<a href test". How does Twitter do it?
...
- 737
8
votes
3
answers
13k
views
Should I use mysqli_real_escape_string or should I use prepared statements? [duplicate]
Should I use mysqli_real_escape_string or should I use prepared statements?
I've seen a tutorial now explaining prepared statements but I've seen them do the same thing as mysqli_real_escape_string ...
- 3,436
5
votes
5
answers
9k
views
should i still sanitise input with mysqli?
I'm using mysqli prepared statements. Should I still sanitise the user input with some function like:
function sanitise($string){
$string = strip_tags($string); // Remove HTML
$string = ...
- 11.2k
0
votes
5
answers
15k
views
php 5.4 magic_quotes_gpc alternative?
I was using php 5.2 earlier. Now I want to upgrade php 5.4. Magic quotes are removed now. I want to make my application work properly. Which function I should use for escaping data ...
- 612
0
votes
3
answers
5k
views
Concrete example of where mysql_real_escape_string fails and Prepared Statements are necessary
I've been sanitising my inputs using mysql_real_escape_string amongst other functions and have recently read that Prepared Statements are the only way to be truly secure. However I am reluctant to use ...
- 213
1
vote
5
answers
1k
views
Inserting data using PHP into mysql when it contains a '
I am writing lots of info from an XML file into a database.
Everything works fine until I come across a field with the ' in the description -- that insertion fails with an error:
Error
1064:You have ...
- 639
1
vote
2
answers
4k
views
Save <script></script> in mysql database with php
I have a cms that I am working on for a client, he wants to add a code textbox so he can paste special code for pages on a page by page basis. So, I need to be able to give the user a way to input ...
- 351
1
vote
1
answer
3k
views
PHP variable in SQL column name
I need to make a SQL update statement in php, and my column name need to be a variable.
I get these variables from jQuery ajax post method and i have them in PHP :
$variable = $_POST['variable'];
$...
- 27
1
vote
4
answers
3k
views
Understanding how to bind parameters and insert data in Adodb
I was told to use bind parameters so that I could insert text into my db that had quotes in it. But, I am pretty confused when it comes to how to do this, the commands seem confusing to me.
So, if I ...
- 42.3k
0
votes
1
answer
2k
views
PHP/SQL Simple click counter button
Tried to make a simple click counter, doesnt work. Whats wrong with my trash code?
addLike.php
<?php
$requestLikes = "SELECT Likes FROM test1";
$Likes = mysql_query($requestLikes);
$...
- 69