What would be the best way to do the following
if(get_magic_quotes_gpc())
{
$location_name = trim(mysql_real_escape_string(trim(stripslashes($_GET['location_name']))));
}
else
{
$location_name = trim(mysql_real_escape_string(trim($_GET['location_name'])));
}
This is the code I have. I think this code is at the root ... OK. Do you think I can safely remove the inner one trim()
. Please don't spam me with an endless version of this, I want to try and learn how to do it better.
UPDATE
So, after reading some of the answers, I think I figured out that it is a good method to safely retrieve data from a user, store it, and then display it.
On first page load
$foo = trim($_GET['foo']);
if(get_magic_quotes_gpc())
{
$foo = stripslashes($foo);
}
Then, when you come to use this variable as part of the SQL string, even if you don't store data in the database, you should avoid it.
mysql_real_escape_string($foo);
And finally, if you are reading data from a database and want to display it as HTML, such a blog or forum post, you must pass the variable using htmlspecialchars
echo(htmlspecialchars($bar));
Can anyone suggest a better set of features to use? others and then obviously wrap these functions to make it easier to call them.
a source to share
Here:
$location_name = trim($_GET['location_name']);
if(get_magic_quotes_gpc()) $location_name=stripslashes($location_name);
Then there is also SQL injection protection, but don't do that until the very last moment before inserting that var into the SQL query. And even then, don't apply the changes to var itself, but rather to the copy. You might want to display the $ location_name to the user (for example, if the form fails). So
$sql="UPDATE whatever(location) VALUES('" . mysql_real_escape_string($location_name) . "')"
I'm assuming, of course, that $ location_name ends up in the database; otherwise you won't need mysql_real_escape_string.
Finally, you want to use htmlspecialchars if you are going to display $ location_name on your page somewhere.
Edit: You want to use htmlspecialchars () just before displaying the data (definitely don't store data that has already been converted by htmlspecialchars in your database). In general, you want to use the escaping functions at the last moment and then on a copy of your var. This way you know that at any point during the script the var is original and does not carry some random escape characters from the transformation that happened somewhere before.
You also know where your escape functions should / should be. sql escaping is next to your sql query. XSS escaping (htmlspecialchars) is next to the part where you display the data on the webpage.
Finally, once you get the hang of things, you can always ditch the SQL escaping by using PHP PDO functions. Also in the future, you may want to look at this: Do htmlspecialchars and mysql_real_escape_string provide PHP code from injections?
a source to share
I'm sorry, but everything in your question is wrong.
First, it has nothing to do with performance, by any means. these functions never bottleneck and never cause performance problems.
Then you chose the wrong place to get rid of the magic quotes. Magic quotes are database related inputs. Better to make a separate function and put it in your config file by including it in every script. You can use one of here
So the code will look like this:
$location_name = mysql_real_escape_string(trim($_GET['location_name']));
But I highly recommend that you do not mix database with any other, since everything else is optional and database escaping is strict and unconditional.
a source to share