My friend recomended putting an escape_data function in this...

[inVINCEable]

So here is my register.php, and as you can guess, registered users for my site. My friend suggested I put this little bit of code saying it would take care of any input that was put in and it would take care of any problems with the characters input by the user such as backslashes, etc. Here is this code he said to include.

 

function escape_data ($data) { 
global $dbc //declares by mysql_connect global
if (ini_get('magic_quotes_gpc')) { 
$data = stripslashes($data); 
} 
return mysql_real_escape_string(trim($data), $dbc); 
} 

 

 

Now he said I would now be able to call escape_data anywhere throughout my website to fun the string through this function. Any input on this technique is greatly appreciated.

 

 

 

[inVINCEable]

Nobody has a comment on this ?

[Hypnos]

Your friend is right. Using something like that helps against SQL injection.

 

Just make sure you call it in your querys.

 

Like:

$query = 'SELECT * FROM `table` WHERE `user` = \'' . escape_data($_POST['username'] . '\'';