5 replies to this topic

[Chris.]

I was wondering if something like this would protect from SQL Injection. Here is the code (Got it from PHP, I just want to be sure).

function quote_smart($value)
{
   if (get_magic_quotes_gpc()) {
	   $value = stripslashes($value);
   }
   if (!is_numeric($value)) {
	   $value = "'" . mysql_real_escape_string($value) . "'";
   }
   return $value;
}

thanks

[Hayden]

I've always believed that htmlspecialchars() and strip_tags() would help with validating user input before using it.

[Mr. Matt]

Yes when I use values I have a global function which does strip_tags, htmlspecialchars and mysql_real_escape_string.

can never be too sure these days.

Matt

[Matthew.]

The code you posted above will work (just wondering why you are adding a single quote to the escaped value?) however checking for both magic quotes and if the value i numeric is pretty inefficient especially since it will be used many times during the script. I use a function that reverses the effect of magic quotes (strips the string of slashes) to add superglobals before i use them so i can simply add the slashes myself (using addlsashes or mysql_escape_string).

However for you this will do fine:

$value = addslashes( stripslashes( $value ) );

If you do not strip the slashes first you will end up with a double escaped string due to magic quotes which is an annoyance when using it as you will only end up having to use stripslashes again.

As long as the quotes are escaped you will have no problems.

Edited by Matthew., 11 October 2006 - 06:57 AM.

[rc69]

Actually, htmlspecialchars and strip_tags do nohting to validate input or protect mySQL. In fact, doing both to the same string is a waste of time. The only time you would want to run either is when you're going to dislpay info in something like a shoutbox.

Personally, i think the follwing would work better (for strings to be used in mysql queries only).

function quote_smart($value){
   if (get_magic_quotes_gpc()){
	   $value = stripslashes($value);
   }

   return mysql_real_escape_string($value);
}

[dEcade]

Just a general question, what does the get_magic_quotes_gpc() and get_magic_quotes_runtime() do exactly. I was searching on php.net but didn't find a good definition.

EDIT: Did some digging and found everything out

dEcade

Edited by dEcade, 12 October 2006 - 05:07 PM.