Go Back   CodingForums.com > :: Server side development > PHP

Before you post, read our: Rules & Posting Guidelines

Reply
 
Thread Tools Rate Thread
Enjoy an ad free experience by logging in. Not a member yet? Register.
Old 01-08-2010, 11:06 AM   PM User | #1
attasz
New Coder

 
Join Date: Nov 2009
Posts: 59
Thanks: 9
Thanked 0 Times in 0 Posts
attasz is an unknown quantity at this point
PHP security

Hy! I found this code:
PHP Code:
function cleaninput($clean){
        
$clean trim($clean);
        
$clean htmlentities($clean);
       
        if (
get_magic_quotes_gpc() == 0){
                
$clean mysql_real_escape_string($clean);
        }else{
                
$clean mysql_real_escape_string(stripslashes($clean));
        }
       
        return 
$clean;
}


$username cleaninput($_POST['username']);
$password cleaninput($_POST['password']);

?> 
As far as i'm familiar with PHP it seems good.However if i try to use it in my script i get this:
Quote:
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'SYSTEM'@'localhost' (using password: NO) in K:\wamp\www\gyakorlo\reg.php on line 5

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in K:\wamp\www\gyakorlo\reg.php on line 5
Despite this the INSERT query is done,but i get empty fields in the database.
if i don't use this function everything is all right,I don't get what is the problem,can somebody help me?
attasz is offline   Reply With Quote
Old 01-08-2010, 11:08 AM   PM User | #2
abduraooft
Supreme Master coder!

 
abduraooft's Avatar
 
Join Date: Mar 2007
Location: N/A
Posts: 14,680
Thanks: 158
Thanked 2,182 Times in 2,169 Posts
abduraooft is just really niceabduraooft is just really niceabduraooft is just really niceabduraooft is just really niceabduraooft is just really nice
Quote:
Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in K:\wamp\www\gyakorlo\reg.php on line 5
A connection to your DB need to be established, before calling that function. (Check the manual)
__________________
Quote:
The Dream is not what you see in sleep; Dream is the thing which doesn't let you sleep. --(Dr. APJ. Abdul Kalam)
abduraooft is offline   Reply With Quote
Users who have thanked abduraooft for this post:
attasz (01-08-2010)
Old 01-08-2010, 11:19 AM   PM User | #3
attasz
New Coder

 
Join Date: Nov 2009
Posts: 59
Thanks: 9
Thanked 0 Times in 0 Posts
attasz is an unknown quantity at this point
Thx,it works now,i had a hard hour with it earlier...
One more question:is it proper defense against mysql injection and other dirty things?
attasz is offline   Reply With Quote
Old 01-08-2010, 11:33 AM   PM User | #4
abduraooft
Supreme Master coder!

 
abduraooft's Avatar
 
Join Date: Mar 2007
Location: N/A
Posts: 14,680
Thanks: 158
Thanked 2,182 Times in 2,169 Posts
abduraooft is just really niceabduraooft is just really niceabduraooft is just really niceabduraooft is just really niceabduraooft is just really nice
Quote:
One more question:is it proper defense against mysql injection and other dirty things?
Umm.. your function cleaninput() can prevent sql injections and problems when having html tags in user input.
__________________
Quote:
The Dream is not what you see in sleep; Dream is the thing which doesn't let you sleep. --(Dr. APJ. Abdul Kalam)
abduraooft is offline   Reply With Quote
Old 01-08-2010, 11:38 AM   PM User | #5
attasz
New Coder

 
Join Date: Nov 2009
Posts: 59
Thanks: 9
Thanked 0 Times in 0 Posts
attasz is an unknown quantity at this point
Thx again!
attasz is offline   Reply With Quote
Reply

Bookmarks

Jump To Top of Thread


Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +1. The time now is 08:03 PM.


Advertisement
Log in to turn off these ads.