Protecting Against a mysql attack?

[Guest]

Hi Everyone,

 

I have a form on my website where I allow people in insert information. That information will go into my database. My question is, how do I make sure the user/visitor isn't inputting apostrophe's into my database? Below I'm using the ergi_replace function which doesn't seem to work. What else can i do?

 

$variable = stripslashes($variable);

$variable = mysql_real_escape_string($variable);

$variable = eregi_replace("'", " ", $variable);

 

Thanks

[AyKay47]

The user can input apostrophe's without tampering with the SQL code as long as mysql_real_escape_string() is called on the data before using it in the SQL statement. This will escape any potentially harmful characters so they are not parsed as literal characters.