Alternative to addslashes

Thread title: Alternative to addslashes

Thread tools

Search this thread

Display Modes

12-31-2007, 04:37 PM

phpintheusa

Status: I'm new around here
Join date: Dec 2007
Location: Tennessee
Expertise:
Software:

Posts: 20

iTrader: 0 / 0%

phpintheusa is on a distinguished road

Alternative to addslashes

I noticed that a lot of people are relying soley on addslashes() with validating user posted data in php. I recommend using something like this instead, this will help prevent sql injections more thoroughly and cross site scripting.

Code:

function validateit($value) {
	$value = str_replace('javascript:', '_', $value);
	$value = str_replace('document.location', '_', $value);
	$value = str_replace('vbscript:', '_', $value);
	$value = str_replace('<marquee', '_', $value);
	$value = str_replace('<script', '_', $value);
	$value = str_replace('?php', '_', $value);
	$value = mysql_real_escape_string(strip_tags(htmlentities(trim($value))));
	return $value;
}