Best way to sanitize POST / GET variables from form / URL?
Possible Duplicate:
Best Way to Stop SQL Injection in PHP
I am creating a website using PHP that uses a MySQL database and processes forms and variables from a URL. These variables are used to dynamically build SQL query strings. So I need a robust solution to make sure no one tries SQL injection etc. A friend of mine said that really I should only use stored procedures to access the database, but that is not really doable because the host I am using doesn't allow this.
Here is the code I am using (this is part of the class for porting DB commands):
...
public function Sanitize($Variable)
{
if(is_resource($this->ServerConnection))
{
$Variable = str_replace(";", "", $Variable);
if(get_magic_quotes_gpc())
{
if(ini_get('magic_quotes_sybase'))
{
$Variable = str_replace("''", "'", $Variable);
}
else
{
$Variable = stripslashes($Variable);
}
}
return mysql_real_escape_string($Variable, $this->ServerConnection);
}
else
{
$this->PrintError("The Sanitize function is not available as there is no server connection.");
}
}
...
Is this feature reliable enough? Should I do anything else?
a source to share
What's the best way ...
There is no better way. It depends on the context.
.. clearing POST / GET variables from.
This is a misguided way of thinking that data is good or bad. Data is just data. This is the context in which it was used, which makes it malicious or not. Some words can be bad if you execute them without storing them on the database server. Some words are bad if you show them to minors. It's about context.
a source to share