[The Geek]

Why preg_replace?

I thought that a sql injection was when you did something like:

$myval=$_POST['myvalus'];
$results=$DB_site->query("SELECT * FROM bob WHERE frank='$myval'");

SInce there is no cleansing of $myval, people could take advantage of it by maybe creating a page that posted the $myval variable to be something like

PHP Code:

yea'; INSERT MALICIOUS CODE HERE 


SInce there is an apostraphe in there, your SQL command ends and people can append system commands after it.

Using addslashes escapes characters that would break the 'string' representation of the above so it would end up:

yea\'; INSERT MALICIOUS CODE HERE


Now they couldnt escape out of the string no matter how much system code was put in.

It was my understanding that globalize uses addslashes on STR's, intval on INTs (which turns the above into 0 as it isnt an integer) and it also addslashes AND converts HTML characters into codes when using STR_NOHTML.

Am I missing something?