SOLVED! - sql injection testng / sql error handling

[Vaupell]

Originally Posted by bananalive

Create Secure Mods

yeah well, allready got that covered, does not exclude the error display on sql error.

was looking for something more along the lines of error handling as we
would in C#,

On error goto (link to error handling)

ALL userimput i get from the template i handle like this

PHP Code:

$vbulletin->input->clean_array_gpc('p', array(
'Rtitle'             => TYPE_STR,

    $Rtitle =& htmlspecialchars_uni($vbulletin->GPC['Rtitle']); 


would you still be using $db->escape_string( for each insert in the db ?

inserting into db like this


Exsample

PHP Code:

$db->query_write("INSERT IGNORE 
                 INTO ".TABLE_PREFIX."mytesttable 
                 (RID, Rtitle, Rdesc) 
                 VALUES ('', '".$Rtitle."', '".$Rdesc."')
                  ");