prevention of db injection?

[ollie007]

what are the metods to prevent database injection?

 

striplashes, striptags?

[adrek]

u can use strip tags and that will remove any html tags. instead of strip slashes you want to use addslashes that way it will put an escape character in front of quotes. ie turning 'hello world' into \'hello world\'. another alternative is using htmlspecialchars or htmlentities if you want to keep the tags intact. these will just change the html characters into there respective character codes.

[smerny]

mysql_real_escape_string()

 

http://www.w3schools.com/php/func_mysql_real_escape_string.asp

[pkedpker]

function escape_string ($string) {
if(version_compare(phpversion(),"4.3.0")=="-1") {
	return mysql_escape_string($string);
} else {
	return mysql_real_escape_string($string);
}
}

 

what I use and it doesn't call php function it calls extension.mysql.dll file which requires you to have a connection to database (no idea why).. but yah. thats it