htmlentities(), strip_tags(), utf8_decode(), stripslashes ()

[Miss-Ruth]

I'm using the following filters to prevent email injection. Is this sufficient to prevent an injection/hijacking? or am I missing something?

 

$email = $_POST['email'];
$email = strip_tags($email);
$email = htmlentities($email);
$email =utf8_decode($email);
$email = stripslashes ($email);
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);

 

I really appreciate your feedback.

[fenway]

Removing tags, html entities, UTF-8 characters, slashes and non-email characters won't help you in you haven't escaped SQL metacharacters.

[Miss-Ruth]

is that "preg_match()"?

[fenway]

is that "preg_match()"?

Nope -- that's just a regex call.

[Miss-Ruth]

Nope -- that's just a regex call.

 

Well... what's the function are you referring to?

[fenway]

Usually the DB interface class exposes some sort of quote() function... depends on how you're connecting.

[Miss-Ruth]

Interesting. Please tell me what do you mean by "depends on how you're connecting".

[fenway]

I mean it depends which DB class you're using.