Just about to start.......

[jas4]

a placement recieved through uni(well that a lie actually...have 2 interviews tomorrow!..but hopeful) where I will have to develop a front end and back end to this companies site.

 

Done plenty of sites/databases etc in uni, but not anything that I would consider up to a secure/good enough standard yet.

 

Obviouisly I want to learn how to do this and this placement would be perfect. A couple of the things I'm worried about is the back end stuff, such as sql injection and just generally making sure its watertight code.

 

Any help/advice would be appreciated.

 

cheers

 

 

[per1os]

I use this for sql injection, note works with mysql but you may need to change the mysql_real_Escape_String code to fit the db you are working with. This will require a db connection to escape.

 

<?php
function escape_string($string) {
    return  get_magic_quotes_gpc()?mysql_real_escape_string(stripslashes ($string)):mysql_real_escape_string($string);
}
?>

 

Using that on any strings that come from a form should prevent sql injection.

[chrisuk]

another vote for mysql_real_escape_string here