SQL Injection Qs
 

How do you strip non alphanumeric characters from a string? I noticed people suggesting globalize() then setting each variables type to STR or INT, etc. Does the STR do that (I noticed it uses trim).

How does using trim compare with addslashes or the built-in mysql commands?

Thanks

Have you read the relevant manual pages for trim() and addslashes()?

Yes, read both of them.

Produces \'a\'

and

produces 'a'

How would I just show the a?

I think you would use stripslashes() when accessing the information with whatever query. I'm still learning too though.

If you want to REMOVE all quotes, you would have to use a str_replace or preg_replace.

If you just want to create a version of your string that is safe to insert into a SQL, use addslashes to store, and if needed stripslashes later to retrieve the original string (vB does stripslashes automaitc in some cases).

Or use mysql_real_escape_string() instead of addslashes.
I am writing a script for my site which is not vB powered, and it automatically strips the slashes from the mysql_real_escape_string()'d result.

Yep mysql_real_escape_string should be used instead of addslashes :) To strip non-alphanumeric characters you would use something like this:

I still have not found a good reason to prefer mysql_real_escape_string above the defacto standard in vB scripts addslashes.

You should probably avoid using it as vB is designed (mostly) so that the database layer is below the application layer. Rephrased, it is not coded to be used just with MySQL through the use of the database wrapper class which can be modified to use any other supporting SQL-capable database.

It seems to escape more than quotes, but I thought it was only quotes that caused the problem. For example, it also escapes newlines for some reason. But, they wrote a full page on SQL injection at http://us4.php.net/manual/en/securit...-injection.php .

You are talking about mysql_real_escape_string i suppose?