[SOLVED] Commas in INSERT statement

[Canman2005]

Hi all

 

I am currently building a system for one guy to use, it contains quite a few INSERT statements, but I have not delt with the possibility of commas being used.

 

What would be the best way to deal with commas being using in INSERT statements?

 

Thanks

[DarkWater]

It should be fine because the string would be in ' ', and you should be using mysql_real_escape_string() anyway.

[Canman2005]

thanks

 

would mysql_real_escape_string() solve any possible INJECTION attacks?

 

If so, is there a way to set it universally on the system?

[DarkWater]

You can't "universally set it", so you have to manually use it on every piece of data being used in a query.

[Canman2005]

okay, so would it be something like

 

$username = mysql_real_escape_string($_POST['username']);

 

?

 

If so, is there any issues doing

 

$_POST['username'] = mysql_real_escape_string($_POST['username']);

 

to save editing all the insert statements?

[redarrow]

very secure way mate...........

<?php

//array_pop($_POST); //only  use if it an array.......

   // Stripslashes
   
if (get_magic_quotes_gpc()) {
       $value = stripslashes($value);
   }

   // Quote if not integer

   if (!is_numeric($value) || $value[0] == '0') {
       $value = "'" . mysql_real_escape_string($value) . "'";
   }
   return $value;
}
?>

[redarrow]

$_POST['username'] = mysql_real_escape_string($_POST['username']); <<< unindexed

 

 

$username=mysql_real_escape_string($_POST['username']); <<<< correct way........

[Canman2005]

if (get_magic_quotes_gpc()) {

      $value = stripslashes($value);

  }

 

  // Quote if not integer

 

  if (!is_numeric($value) || $value[0] == '0') {

      $value = "'" . mysql_real_escape_string($value) . "'";

  }

  return $value;

}

 

didnt seem to work, ill do it with the

 

mysql_real_escape_string

 

funtion

 

Thanks