mysql_real_escape_string Use

[Mutley]

If I have a variable such as:

$member = $_GET['member'];

Do I put mysql_real_escape_string like this:

[code]
$member = $_GET['member'];
mysql_real_escape_string($member)
[/code]

How would I use this with forms? If I wanted to stop people putting malicious code in the forms? Thanks.

[obsidian]

You would use it in the same way, but you would apply it to the text they have submitted before you attempt to insert it into a database. You may also want to run some other checks against entries like strip_tags(), too.

[Mutley]

So where I post the form info like:

[code]$abc = $_POST['abc'];
$abc2 = $_POST['abc2'];
$abc3 = $_POST['abc3'];[/code]

I would do:
[code]$abc = $_POST['abc'];
mysql_real_escape_string($abc)
$abc2 = $_POST['abc2'];
mysql_real_escape_string($abc2)
$abc3 = $_POST['abc3'];
mysql_real_escape_string($abc3)[/code]

...or can I simply do it on the query:
[code]$sql = "Insert into...."
mysql_real_escape_string($sql)[/code]

What happens if it detects a malicious code? Does it echo anything or display anything?

[obsidian]

First, we better define what "malicious code" is and how it is detected. mysql_real_escape_string() simply fully escapes a string for safe insertion into a MySQL database. So, to oversimplify, it helps escape all the floating quotes within text that may cause a query to end prematurely. This alone is not enough to avoid [i]malicious code[/i]. People could insert HTML or even javascript into a form on your page and cause real problems as well. So, be sure you account for these things as well. To answer your specific question, be aware that the function [b]returns the string passed once it has been escaped[/b], so you want to assign the results to the variable you will be using:
[code]
<?php
$abc = mysql_real_escape_string($_POST['abc']);
?>
[/code]

Often, I'll actually create a function that will loop through all my $_POST variables and prepare them all individually so I don't have to deal with them:
[code]
<?php
function cleanPost() {
  foreach ($_POST as $key => $val) {
    $val = strip_tags($val);
    $val = mysql_real_escape_string($val);
    $_POST[$key] = $val;
  }
}
?>
[/code]

Hope this makes sense.

[Mutley]

Thanks a lot, making more sense now.

So with the function, can I make a PHP file or even include it in my header file, then it will resolve all the $_POST variables.

Does strip_tags remove all PHP and HTML tags, like <?php <? <br /> <p> and so on?

[obsidian]

Yes, if you include that function declaration within your scripts, you can clean all $_POST variables with one function call. To answer your second question, check out the manual for [url=http://www.php.net/strip_tags]strip_tags()[/url] for specifics, but it simply removes [b]all[/b] HTML tags by default. It will allow you to specify which tags you want to allow. This helps because it also removes all <script> tags.

[Mutley]

How do I stop the cleanPost() function on certain $_POST ? I have parts I do and don't want to strip_tags.

[obsidian]

[quote author=Mutley link=topic=120021.msg492135#msg492135 date=1167237215]
How do I stop the cleanPost() function on certain $_POST ? I have parts I do and don't want to strip_tags.
[/quote]
Just modify your function to accept exceptions. Something like this usually works for me. You pass in an array of field names you want the function to skip over:
[code]
<?php
function cleanPost($exceptions = array()) {
  foreach ($_POST as $key => $val) {
    if (!in_array($key, $exceptions)) {
      $val = strip_tags($val);
    }
    $val = mysql_real_escape_string();
    $_POST[$key] = $val;
  }
}
?>
[/code]

Hope this makes sense.

[Mutley]

So in the array something like:

[code]array($_GET['this'];, $_GET['that'];)[/code]

[obsidian]

[quote author=Mutley link=topic=120021.msg492352#msg492352 date=1167262881]
So in the array something like:

[code]array($_GET['this'];, $_GET['that'];)[/code]
[/quote]

Actually, you only need the actual key names of the ones you want left out:
[code]
<?php
// This will skip over $_POST['this'] and $_POST['that']
$exceptions = array('this', 'that');
cleanPost($exceptions);
?>
[/code]

[Mutley]

Having trouble with this.

How do I stop special characters? As I can still put !"$!£&*$&"/$\ etc and it allows it, only until I do actual HTML tags and things it blocks.