Attack Prevention

[tracy]

Is there a simple line or two of code that I can place in my php pages (working with mysql also) to prevent injection attack?  Thanks.

[genericnumber1]

[code=php:0]
function quote_smart($value) {
  // Stripslashes
  if (get_magic_quotes_gpc()) {
      $value = stripslashes($value);
  }
  // Quote if not a number or a numeric string
  if (!is_numeric($value)) {
      $value = "'" . mysql_real_escape_string($value) . "'";
  }
  return $value;
}
[/code]

taken from http://www.php.net/mysql_real_escape_string

[redarrow]

at minuam use addslashes

[willfitch]

I wouldn't recommend addslashes.  If your DB charset is set to GBK multi-byte, one could still inject your script like so:

addslashes would change 0xbf27 to 0xbf5c27, which is a valid multi-byte character followed by a single quote

[url=http://www.phpfever.com/php-security-sql-injection-overview.html]http://www.phpfever.com/php-security-sql-injection-overview.html[/url]

[tracy]

thanks to all responding to this...I am researching your ideas.  Other ideas welcome.  Thanks again.