mysql_real_escape_string() Question

[Startses]

I made the following function to validate info being sent to my database:

 

function valid($text){
$text = str_replace(" ","", $text);
	if (empty($text))
		return false;

$text = eregi_replace("([a-z0-9]+)","",$text);

if (empty($text))
	return true;
else
	return false;
}

 

would this be enough or would I still need to use mysql_real_escape_string() for some reason?

It only allows lowercase and numbers, unless I'm missing something?

[The Little Guy]

I would recommend using use mysql_real_escape_string() on EVERYTHING!!!

[PugJr]

A question: Whats the penalty of not being safe? Safe than sorry when you are questioning over some very small ammount of computing power.

[PugJr]

I would recommend using use mysql_real_escape_string() on EVERYTHING!!!

 

 

No. Not everything. Only use it on things that people can submit into AND that goes into your database.

[The Little Guy]

Yeah, that Is what I meant.

[RestlessThoughts]

Nah, that should be enough, there's no SQL that can be done with just lowercase and numbers.

[PFMaBiSmAd]

Unfortunately, hexadecimal encoded characters can be used to inject sql (you can inject things like single-quotes without supplying actual single-quotes by using hexadecimal), so things like the following (harmless examples) would get past the eregi_replace code that was posted  -

 

0x274d7953514c27

0x275061756c27

 

[Daniel0]

Unfortunately, hexadecimal encoded characters can be used to inject sql (you can inject things like single-quotes without supplying actual single-quotes by using hexadecimal), so things like the following (harmless examples) would get past the eregi_replace code that was posted  -

 

0x274d7953514c27

0x275061756c27

 

 

Yeah, but even:

 

INSERT INTO foo (bar) VALUES ('0x275061756c27');

 

Wouldn't work (from an attacker's point of view). If you've made sure that your string only contains alphanumeric characters and you delimit the string in quotes there is no way any SQL injection vulnerability would be possible.