mysql - PHP Injection protect function -


hello searching on internet protection attacks , have gathered codes not sure if doing same job or if useless or not. 1-2 tips welcome new in php. here function use every thing goes in/out of sql:

public static function safe($str = '') {     $ret_string = $str;     $ret_string = htmlspecialchars($ret_string);     $ret_string = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($ret_string) : mysql_escape_string($ret_string);     $ret_string = strip_tags($ret_string);     $ret_string = stripslashes($ret_string);     $ret_string = htmlspecialchars($ret_string);     $ret_string = trim(htmlentities($ret_string));     $ret_string = trim($ret_string);     $ret_string = str_replace('\\l', '', $ret_string);     $ret_string = str_replace('\\', '', $ret_string);     $ret_string = str_replace("%00", "",$ret_string);     $ret_string = str_replace(' ', '', $ret_string);     $ret_string = str_replace("'", "", $ret_string);     $ret_string = str_replace("\"", "",$ret_string);     $ret_string = str_replace("--", "",$ret_string);     $ret_string = str_replace("-", "",$ret_string);     $ret_string = str_replace("^", "",$ret_string);     $ret_string = str_replace("&", "",$ret_string);     $ret_string = str_replace("%", "",$ret_string);     $ret_string = str_replace("(", "",$ret_string);     $ret_string = str_replace(")", "",$ret_string);     $ret_string = str_replace("=", "",$ret_string);     $ret_string = str_replace("+", "",$ret_string);     $ret_string = str_replace(";", "",$ret_string);     $ret_string = str_replace(":", "",$ret_string);     $ret_string = str_replace("|", "",$ret_string);     $ret_string = str_replace("<", "",$ret_string);     $ret_string = str_replace(">", "",$ret_string);     $ret_string = str_replace("~", "",$ret_string);     $ret_string = str_replace("`", "",$ret_string);     //extra ansi attacks     $ret_string = str_replace("0x22", "",$ret_string);     $ret_string = str_replace("0x25", "",$ret_string);     $ret_string = str_replace("0x27", "",$ret_string);     $ret_string = str_replace("0x5c", "",$ret_string);     $ret_string = str_replace("0x5f", "",$ret_string);     //extra hex attacks     $ret_string = str_replace("\x00", "",$ret_string);     $ret_string = str_replace("\n", "",$ret_string);     $ret_string = str_replace("\r", "",$ret_string);     $ret_string = str_replace("\x1a", "",$ret_string);     $ret_string = str_replace("%20and%20", "",$ret_string);     return $ret_string; }

you don't need this. use prepared statements parameters, way don't need escape anything.


Comments

Post a Comment

Popular posts from this blog

javascript - RequestAnimationFrame not working when exiting fullscreen switching space on Safari -

request animation frame stops working when exiting fullscreen clicking on original space's safari window. fine if fullscreen mode canceled escape key or calling cancelfullscreen(). steps reproduce: open https://dl.dropboxusercontent.com/u/769042/prezi/safari-fullscreen.html click "draw raf", kittie appears click "fullscreen", go fullscreen click "draw raf", kittie appears go space original safari was, showing "click exit fullscreen mode", click anywhere, out fullscreen click "draw raf", nothing happens what handling click calling: window.requestanimationframe(draw); which draws on canvas context: function draw() { ctx.drawimage(img, math.random()*500|0, math.random()*400|0, 100, 100); } i checked .hidden , .visibilitystate, updated correctly. tested on osx 10.9.3, safari 7.0.4 (9537.76.4). has workaround/solution other switching old settimeout? this sounds webkit bug 88940 : using reque...
Read more

Python ctypes access violation with const pointer arguments -

i have api i'm trying wrap in python (2.7.6 on win7) code using ctypes. here's api: client_dllfunc bool clientapi search_exporttoclipcopy(clienthsearch handle, int channel, lpctstr filename, const time_t& from, const time_t& to, const bool* cameras, int length, bool usepassword, lpctstr password, bool includetextin = false, bool excludeplayer = false); the issue i'm having cameras argument; , i've had issue other const pointer arguments well. here's how i'm wrapping api: def search_exporttoclipcopy(self, hsearch, csearch, filename, tfrom, tto, cameras, length, usepassword, password, includetextin=true, excludeplayer=false): exporttoclipcopy = self.sdkdll.search_exporttoclipcopy exporttoclipcopy.argtypes = [c_int, c_int, c_wchar_p, c_long, c_long, pointer(c_bool), c_int, c_bool, c_wchar_p, c_bool, c_bool] exporttoclipcopy.restype = c_bool exporttoclipcopy(hsearch, csearch, filename, tfrom, tto, cameras, length, usepassword, pass...
Read more

jquery - Keeping Kendo Datepicker in min/max range -

when user types type in date outside of range, we're trying ensure date gets changed closest min/max. text displayed in date picker not change though thought script changing value() @(html.kendo() .datepickerfor(x => x.dob) .max(new datetime(datetime.now.addyears(-18).year, datetime.now.addyears(-18).month, datetime.now.addyears(-18).day)) .min(new datetime(datetime.now.addyears(-70).year, datetime.now.addyears(-70).month, datetime.now.addyears(-70).day)) .events(e=>e.change("ondobchange")) .htmlattributes(new { required = "required", ng_model = "model.dob" })) <p ng-show="validatestate.submitted && frmmain.dob.$invalid" class="help-block">please select</p> <script> function ondobchange(e) { var d...
Read more