note 102794 added to security.database.sql-injection
[email protected] Mon, 7 Mar 2011 03:45:41 -0800
Newsgroups
php.notes
Message-ID
<[email protected] >
function secure($array) {
$newArray = array();
foreach($array as $key => $value) {
if (is_array($value)) {
$newArray[$key] = secure($value);
}
else {
$newArray[$key] = htmlspecialchars(stripslashes($value));
$newArray[$key] = str_ireplace(
array (
'*',
'#',
'SELECT ',
'UPDATE ',
'DELETE ',
'INSERT ',
'DROP ',
'--',
'1=1',
'INTO',
'VALUES',
'FROM',
'LEFT',
'JOIN',
'WHERE',
'LIMIT',
'ORDER BY',
'AND',
'OR ',
'DESC',
'ASC',
'ON '
),
'BadChar',
$newArray[$key]
);
$newArray[$key] = mysql_real_escape_string($newArray[$key]);
}
}
return $newArray;
}
if($_REQUEST){
$_GET = secure($_GET);
$_POST = secure($_POST);
}
----
Server IP: 69.147.83.197
Probable Submitter: 122.177.228.128
----
Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php
Edit -- https://master.php.net/note/edit/102794
Del: integrated -- https://master.php.net/note/delete/102794/integrated
Del: useless -- https://master.php.net/note/delete/102794/useless
Del: bad code -- https://master.php.net/note/delete/102794/bad+code
Del: spam -- https://master.php.net/note/delete/102794/spam
Del: non-english -- https://master.php.net/note/delete/102794/non-english
Del: in docs -- https://master.php.net/note/delete/102794/in+docs
Del: other reasons-- https://master.php.net/note/delete/102794
Reject -- https://master.php.net/note/reject/102794
Search -- https://master.php.net/manage/user-notes.php