mysql_real_escape_string(htmlspecialchars( $value )); is enough? how can i easly improve it?

Question

i'm using this in every $_get or $_post before acces or insert to my Database..

i'm sure it's not enough.. but how safe is it? can i combine it with some expresion to make it safer?

thanks a lot!

so how about this? mysql_real_escape_string(htmlspecialchars( $value ));

htmlspecialchars has nothing to do with making it safe for database entry. Use the database's escape function or parameterized queries (PDO) for that. — webbiedave
– webbiedave, Commented Jan 13, 2011 at 18:03
your change of subject and body makes the answers look inadequate: looks like you've asked "should I do A" and the answers are "no, you should do A". So I suggest that you revert your modifications. — Eugene Mayevski 'Callback
– Eugene Mayevski 'Callback, Commented Jan 13, 2011 at 19:30

Klaus Byskov Pedersen · Accepted Answer · 2011-01-13 18:00:50Z

5

No, that is not enough. You should use mysql_real_escape_string to prevent sql injection attacks.

answered Jan 13, 2011 at 18:00

Klaus Byskov Pedersen

122k31 gold badges192 silver badges222 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Klaus Byskov Pedersen Over a year ago

@Toni, yeah, it looks better. I would however save the raw values (eg. without using htmlspecialchars). When you retrieve the values and show them on some page you can use htmlspecialchars to prevent XSS attacks, but there is no need to save the string encoded.

Toni Michel Caubet Over a year ago

so is thre a way to make a function like if(string_not_dangerous($string)){ save_normal_sting;} else { show(go_to_hell)} ?

Toni Michel Caubet Over a year ago

i was considering Dreamweaver Replace all open documents: htmlspecialchars -> mysql_real_escape_string,

user463535 · Accepted Answer · 2011-01-13 18:02:30Z

0

mysql_escape_string($value) is a bit smarter when sanitizing strings that will be used in an SQL query.

answered Jan 13, 2011 at 18:02

user463535

Comments

redwall_hp · Accepted Answer · 2011-01-13 18:13:51Z

0

You should use mysql_real_escape_string() to protect your database from injection attacks (or better yet, prepared statements with something like the PDO library) and htmlspecialchars() when you're displaying data pulled from a database.

answered Jan 13, 2011 at 18:13

redwall_hp

1,0772 gold badges10 silver badges18 bronze badges

Collectives™ on Stack Overflow

mysql_real_escape_string(htmlspecialchars( $value )); is enough? how can i easly improve it?

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related