Is this vulnerable to SQL injections?

[micmania1]

Hi, i've looked around the web for reasons to use either mysql_real_escape_string or addslashes and both have vulnrabilities.

 

I want to use addslashes because it is more to my needs, however is more vulnrable.

 

addslashes vulnerability

 

Vulnerabilities for both

 

I'm not too clued up on injection techniques so was hoping one of you could be of assistance.

 

function escape_data($data) {
$data = str_replace('0x', '0\x', $data);
$data = addslashes($data);

// Chars not escaped by addlashes()
$escape = array('%', '--');
$replace = array('\\%', '-\\-');

$data = str_replace($escape, $replace, $data);

return $data;
}

How secure is that function?

 

[waynew]

mysql_real_escape_string() is the safest. It is only vulnerable when you are changing between charsets. And seeing as people rarely change charsets etc, I doubt that this said "vulnerability" is going to affect you. mysql_real_escape_string is from MySQL's side, whereas addslashes is from PHP's side. mysql_real_escape_string takes into account the current charset being used.

 

 

[waynew]

Also, why does addslashes suit your situation more than mysql_real_escape_string() ?

[micmania1]

mysql_real_escape_string escapes line brakes with too many backslashes. stripslashes() does not revert linebreaks back to the origional form. It appears '\r\n'

[waynew]

Then use nl2br()