Protecting against SQL injection

[devWhiz]

Would this be effective in protecting against SQL injection?

 

function runQuery($sqlQuery){
	$sqlQuery = str_replace(array('@@','))'),'\"',$sqlQuery);
	$sqlQuery = str_replace(array('++','--'),"\'",$sqlQuery);
	$sqlQuery = str_replace(array('**','&&'),' ',$sqlQuery);
	$runQuery = mysql_query($sqlQuery) or die(mysql_error());
	return $runQuery;
}

[Pikachu2000]

Is there something wrong with mysql_real_escape_string() for string values, and validating/casting numeric values as the correct data type?

[devWhiz]

I would put the query as the param for mysql_real_escape_string?

 

$query = "SELECT * FROM users";
$escape = mysql_real_escape_string($query);
$run = mysql_query($escape);

 

that query is just an example

[Pikachu2000]

No, you would call it on all values that are of the string data type, that will be used in a DB query string.

 

// connect to database first
$string_value = mysql_real_escape_string($string_value);
$query = "SELECT field FROM table WHERE some_field = '$string_value'";