PHP mysql_* commands and safe them.

[SeaLife]

Hello!

 

Im Building my own Web Site (Demo: 2 ) and i wand to know how to make

 

mysql_query( $sql_query ) safe

 

 

im working with These Commands:

 

 

GetGet('q');

function GetGet($STRING) {
if(!isset($_GET[$STRING])) {
$return = "";
} else {
$return = sql_inj($_GET[$STRING]);
}
return $return;
}

GetPost('post:name');

function GetPost($STRING) {
if(!isset($_POST[$STRING])) {
$return = "";
} else {
$return = sql_inj($_POST[$STRING]);
}
return $return;
}

sql_inj( $string );

function sql_inj($sql) {
error_reporting (E_ALL ^ E_NOTICE ^E_DEPRECATED);
$sql = preg_replace(sql_regcase("/(from|<|>|'|select|insert|delete|where|drop table|show tables|#|\*|--|\\\\)/"),"",$sql);
$sql = trim($sql);
$sql = strip_tags($sql);
$sql = addslashes($sql);
$sql = htmlspecialchars($sql);
return $sql;
}

 

 

and now tell me, if i execute this, if it Safe:

mysql_query("UPDATE t_characters SET a_admin = ('".GetGet('adminlvl')."') WHERE a_nick = ('".GetGet('nick')."');");

 

 

 

 

THX

[Wizatek]

Just learn to use PDO, then u dont need to worry about safe or not, and the code looks a lot nicer also

[mord]

2 <- your best options and PDO is usually the best way to go

[Wizatek]

2

[SeaLife]

But i wont to rewrite my Script because, this script have over 100+ mysql_query commands :O only uses this trim commands to be safe >.<

 

 

And i only want to know, if this would be safe ^^

[Wizatek]

php doesnt declare the complete mysql_ commands deprecated for no reason. 

[Samker132]

Encrypt your passwords and remove all specialchars from the username and the same at the email but there you need to allow this chars "@._-".

function clean_str($str) //function to clean strings
{
$str = @trim($str);
if(get_magic_quotes_gpc())
{
$str = stripslashes($str);
}
$str = preg_replace("/[^a-zA-Z0-9]/" , "" , $str);
return $str;
} // Ende Clean String

use this function for your usernames and for emails change the

$str = preg_replace("/[^a-zA-Z0-9]/" , "" , $str);to$str = preg_replace("/[^a-zA-Z0-9@._\-]/" , "" , $str);
 

Greets