Because this thread has been already bumped, I'll just chip in a little advice.
Methods listed in this thread will not protect you against SQL injection, there are multiple ways to bypass myslq_real_escape_string etc.
mysql_* commands should not be used. Look for mysqli or PDO to handle your queries and always, always, always use prepared statements.
http://net.tutsplus.com/tutorials/php/wh...se-access/
Prepared statements by themselves too don't really help you against SQL injection as explained:
http://stackoverflow.com/questions/13409...-injection
the best way is to make a white-list of allowed characters, length etc. If you need just and id, use regular expressions to get just the number from the users input.
If you allow just a 10 character string and somebody submits 20 character string, either strip it, or report an error.
last but not least, all this is useless if you don't handle encoding correctly in your database. If you don't know how to do this exactly, just set database, table and column encoding to utf-8. That should do the trick most of the time.
tl;dr
- Don't use mysql_* queries. User PDO or Mysqli instead
- Use prepared statements
- Make a white-list (black-lists are proven to be not so effective)
- Make sure your encoding is correct. If you are not sure, use utf-8 EVERYWHERE
![[Image: HC_Signature.png]](http://s12.postimg.org/pf7wssp7x/HC_Signature.png)
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
