preventing SQL injections

does PHP's magic_quotes_gpc do the trick?

[RonPK]

I've read about PHP's magic_quotes_gpc = 1 as a means of preventing SQL injection. However many of those sites also claim that relying on magic_quotes_gpc is not very smart, in fact that magic_quotes_gpc is basically evil.

Can someone shed some light on this? Can I rely on it, and why would it be evil?

[DrDoc]

evil = allows for sloppy programming. It's never good to rely on a built-in function that isn't set by default in later PHP versions.

Use addslashes() instead. That's what PHP themselves recommend.

[brotherhood of LAN]

mysql_escape_string will do the same job, from the horses mouth in the manual:

This function will escape the unescaped_string, so that it is safe to place it in a mysql_query().

[gilmour]

Additionally, crop the form data to your max length with PHP before calling your SQL statement rather than relying on the forms 'maxlength=x' property. Doesn't have anything to do with escaping single or double quotes,...but it's good practice to help prevent SQL injections.

[daisho]

If you are using mySQL use "mysql_escape_string()" for _every_ piece of data that's coming from a user. This is better then addslashes for this case since mysql_escape_string will always properly escape for mysql even if that escaping changes.

If you are using oracle then use Binds (OCIBindByName, OCIBindByNum).

daisho.

[RonPK]

Thx, everyone. It's much more clear to me now.