SQL Injection.. Your opinion..

[ataria]

This is what I have so far.


[code]
<?php

// database connection.
function protect($input)
{
$input = mysql_real_escape_string($input);
$input = eregi_replace("%","",$input);
$input = eregi_replace("--","",$input);
$input =htmlspecialchars(mysql_real_escape_string($input));

return $input;
}

$_COOKIE = array_map("protect",$_COOKIE);
array_map('mysql_real_escape_string', $_POST);
array_map('mysql_real_escape_string', $_GET);

?>
[/code]

Is there anything I need to add?
or, is it good enough?

[btherl]

mysql_real_escape_string() already does the necessary escaping.  As long as you use that string inside single quotes, you will be fine.

There's no need for the other lines.

You might need to urldecode() your input first as well, depending on what type of input it is.

[code=php:0]$escaped_input = mysql_real_escape_string(urldecode($_POST['input']));
$sql = "INSERT INTO table VALUES ('$escaped_input')";[/code]

[ataria]

where would i put that?

[marcus]

Below

[code]
function protect($input)
{
[/code]

[ataria]

Added. Thanks!