+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: mysql_real_escape_string() (/Thread-mysql-real-escape-string)
mysql_real_escape_string() - phiber - 01-17-2014
how can a hacker bypass query filters like addslashes() and mysql_real_escape_string() in a POST parameter?
thanks. I'v searched in google to use multibyte character encoding but it seems slashes are still added to the query.
are those filters good enough to protect my site?
RE: mysql_real_escape_string() - Slarek - 01-17-2014
You should use PDO or mysqli.
RE: mysql_real_escape_string() - idiot - 01-23-2014
dont use addslashes, only the second one and nothing will happen