Injection...protection

[caster001]

Ok, trying to create secure login is getting harder and harder learning about all these ways people can do stuff..

Um, SQL injection attacks...assuming that the whole 'strip tags' in a php script running after the form is posted won't
do the job, what's the best way to prevent them, and do they still count if you're using mysql?

Thanks.

[printf]

You base protection solely on what you need to protect, it makes no sense at all to use addslashes on SUPER GLOBAL arrays, you should create your protection based on the variable it's self. You can do this by creating a simple preprocessing function that is given the SUPER GLOBAL and a sister array() of what each variable should be CAST as, inside that function you do your cleaning based on the variable type. This will save you so much time and makes for a great drop in function for any script you create later on down the road.

When working with a database, PHP has different functions to protect the variables being used in the query, like mysql_real_escape_string ( $var ) for the MySQL database, used for string type variable protection, for numeric type string protection, you can just use intval ( $var ), PHP has other functions like these for other databases too!


printf

[caster001]

thanks, that was a lot of help...took me a while to get it, but I looked up the mysql_real_escape_string thing, and I get it.

:)