[XterM]

hey, this is nice post.

i have a simple way to prevent sql injection attact. usually, hacker test if sql vulnerable by adding a single or doble quote in input variable. like this:

?id=1' or ?id=1"

so, i remove any quote in all variable. i use str_replace().

i see why hacker do to attack sqlinjection vulnerability. like this:

?id=1+order+by+1--
?id=1+union+select+1,2,3--

so, i remove the +,-,%20,*.

i feel this is just little trick, but this so helpfull to prevent sql injection attact :-)