Sanitizing Function

[bobicles2]

function clean($input) {
	$input = @trim($input);
	if(get_magic_quotes_gpc()) {
		$input = stripslashes($input);
	}
	return mysql_real_escape_string($input);
}

 

i orginally had this function, shown above to clean up my inputs and prevent SQL injection. However, Magic_quotes_gpc is no longer supported. and this method although clear to me seems a little long winded!

 

is there an easier way for me to clean up my inputs thoroughly? and to avoid SQL injection

 

 

thanks

rob

[mikesta707]

since magic quotes is no longer supported, I suppose you could just get rid of the if statement. something like

function clean($var){
return mysql_real_escape_string(trim($var));
}

 

should suffice.

 

However, it may be a good idea to keep the if statement so your code is more portable. If you use that code on a server with php 4 or 5 (and magic quotes gpc is enabled) then it may not work as suspected.

 

 

[salathe]

Just because magic quotes is deprecated does not mean a server running this script will always have magic quotes turned off (unless the script will only ever run on your boxes, and you can guarantee it will never be enabled).