[rpgamersnet]

Originally Posted by gmhastings

So for example, when I had finished playing a game, if I enter a comment next to my high scores.. this is what I get..

I type "Finally I get a good score!" ... it will show "Finally I get a good sce!" (the "or" removed)
If i typed something like "I think I upset the dealer in this game" then "upset" would be just "up" so whilst it more than likely removes the chance of some dodgy mysql going in - it is not quite the best. I'm not sure if it would be enough to just put a space after each of the words in the ibp_cleansql as probably other characters can be used..

I'm not sure why you are getting a white screen (or if you got any further) but at least this fuction below gets around using that stristr function ... but I think it would be best if a slightly improved solution is made really because otherwise potentially other legitimate mysql statements might get messed up by using this most recent correction..

I am not an expert, but yes this solution does seem kind of rushed and not the best option. I'd rather disable comments entirely then have random bits disappear and cause confusion. I am not a PHP expert, but there are plenty of commands to strip bad code out of user input.. can these commands not be applied to comments properly so they are only displayed and not executed? Why is the comment field vulnerable when other data input is not? I think something needs to change...