mysql_real_escape_string HELP!!

[icedroplet1987]

Hey friends, i will like to know if i parse all data thru

mysql_real_escape_string

then will it protect my site from sql injection?? and its dark-sides?? any harm using it??

likewise this for all get , post, server etc

$msg = mysql_real_escape_string( $_GET['msg'] );

please leave your valuable comments @ all

[GumSlone]

yes it will

[icedroplet1987]

thnx sir

[eynesilli]

how-to here?

if($message!=""){
if(isspam($message))$spam=" reported='1',";
else $spam="";
$res=mysql_query("INSERT INTO inbox SET text='".$message."', byid='".getuid_sid($sid)."', toid='".$who."',$spam timesent='".time()."'"); 

[wap-ruler]

rep

if($message!=""){
if(isspam($message))$spam=" reported='1',";
else $spam="";
$res=mysql_query("INSERT INTO inbox SET text='".$message."', byid='".getuid_sid($sid)."', toid='".$who."',$spam timesent='".time()."'");

What do u mean by how to plz describe.

[something else]

Hey friends, i will like to know if i parse all data thru

mysql_real_escape_string

then will it protect my site from sql injection?? and its dark-sides?? any harm using it??

likewise this for all get , post, server etc

$msg = mysql_real_escape_string( $_GET['msg'] );

please leave your valuable comments @ all

not always but depends on how your mysql query's are scripted
mysql_real_escape_string() backslashes things such as ' and " however an injection can be as simple as:

OR 1 

(no quotes ^ )

if($message!=""){
if(isspam($message))$spam=" reported='1',";
else $spam="";
$res=mysql_query("INSERT INTO inbox SET text='".$message."', byid='".getuid_sid($sid)."', toid='".$who."',$spam timesent='".time()."'");

use:
[php]
$message = mysql_real_escape_string($message);

[analyzer]

mysql_real_escape_string() will not be enough brother.

[metulj]

Hey friends, i will like to know if i parse all data thru
mysql_real_escape_string
then will it protect my site from sql injection?? and its dark-sides?? any harm using it??
likewise this for all get , post, server etc

$msg = mysql_real_escape_string( $_GET['msg'] );

please leave your valuable comments @ all

mysql_real_escape_string() will not be enough brother.

i dont see why that wouldnt be enough...?? you mind to explain ?

other than that... i do prefer this

$msg = mysql_real_escape_string(strip_tags(htmlspecialchars($_GET['msg']))); 

just to ''sleep better''

[eynesilli]

not always but depends on how your mysql query's are scripted
mysql_real_escape_string() backslashes things such as ' and " however an injection can be as simple as:

OR 1 

(no quotes ^ )



use:
[php]
$message = mysql_real_escape_string($message);

Thanks, but still did not understand anything

[icedroplet1987]

thnx methulj brother.. please also tell, anything wrong in using this?? as i am sure it will protect injection but any harm of it??

other question, i can i make sessions do not expire.. means if user switch off broser n then switch on then also he should be logged in .. just like vbulletin remember me option.. i saw a lavalair site with sessions showing n secured too.. how is it possible n his sessions doesnt expire untill you logout or remove chache.. please enlight this question too @ all..

[metulj]

thnx methulj brother.. please also tell, anything wrong in using this?? as i am sure it will protect injection but any harm of it??

other question, i can i make sessions do not expire.. means if user switch off broser n then switch on then also he should be logged in .. just like vbulletin remember me option.. i saw a lavalair site with sessions showing n secured too.. how is it possible n his sessions doesnt expire untill you logout or remove chache.. please enlight this question too @ all..

i wouldnt use ednless session...
if browser and/or IP has been changed,
i believe it is correct that session is ended
i might be wrong, but i think that way session is also a bit more secured

[icedroplet1987]

but as i said, i saw site with sessions arent hidden n even not destroying (endless) n perfectly secured thats why i asked so.. if you know you or anybody else on this forum knows it then please share the information on this or codes too.

Added after 10 minutes:

i dont see why that wouldnt be enough...?? you mind to explain ?

other than that... i do prefer this

$msg = mysql_real_escape_string(strip_tags(htmlspecialchars($_GET['msg']))); 

just to ''sleep better''

and bro, should i parse even $_session , $_server from it.. // i mean all requests??

[shushant]

but as i said, i saw site with sessions arent hidden n even not destroying (endless) n perfectly secured thats why i asked so.. if you know you or anybody else on this forum knows it then please share the information on this or codes too.

Added after 10 minutes:



and bro, should i parse even $_session , $_server from it.. // i mean all requests??

function clean($do = null){
return isset($do) ? mysql_real_escape_string(strip_tags(htmlspecialchars(trim($do)))) : null;
}

useage

echo clean($_POST['var']);//For Post
echo clean($_GET['var']);//FOR get
echo clean($_SERVER['var']);//FOR server

[StunningNick]

Hey friends, i will like to know if i parse all data thru

mysql_real_escape_string

then will it protect my site from sql injection?? and its dark-sides?? any harm using it??

likewise this for all get , post, server etc

$msg = mysql_real_escape_string( $_GET['msg'] );

please leave your valuable comments @ all

you may find this link helpful

note : below link contains useful info + free some kinda malware so beware :P
http://www.itshacked.com/350/bypassi...-possible.html

Exploiting hard filtered SQL Injections

also if you don't provide proper charset type, mysql_real_escape_string can't help you, cause default charset is set to UTF-8 according to php bugs report it is fixed way back in 2006 but i still found it working on some sites but not all .

[icedroplet1987]

si, is it not safe what methulj is using ha?