submitted data

[iversonm]

i read previously about user submitted data on phpfreaks in a random topic awhile back and it was just about validating all submitted data. they said use magic_quotes???? not sure

 

what is the best function(s) to use to check user submitted data incase the data should just be numbers or alpha numeric or whatever you can think of

[Yesideez]

I use addslashes() when using data in a MySQL query and never use the variables directly within calls, eg.

 

I never do this:

mysql_query("SELECT data FROM table WHERE `field`='$mydata'");

 

But I do this instead:

mysql_query("SELECT data FROM table WHERE `field`='".$mydata."'");

 

Depending on what the data field is, I might add this:

mysql_query("SELECT data FROM table WHERE `field`='".addslashes($mydata)."'");