Is This Good Enough?

ETbyrne · 12-21-2008, 07:40 PM

I have the following function for cleaning data for use with MySLQ and I just wanted to make sure it was sufficient before I used it in a production environment.

PHP Code:


			
function clean($data)
{
    if(ini_get('magic_quotes_gpc'))
    {
            $data = stripslashes($data);
    }
        
    return mysql_real_escape_string($data);
}

Thanks!

xenon · 12-24-2008, 05:54 PM

I'd go with PDO, since data escaping is done automatically for you. Also, the mysqli class does that aswell, but I might be wrong here.

Mathew · 12-24-2008, 06:35 PM

You're right Xenon, mysqli escapes queries automatically.

xenon · 12-25-2008, 10:02 AM

Plus, that way you have the advantage of parameter binding, which offers you (also automatically) query caching. But, if you want to do that by hand, you'd want to run the data through addslashes and not stripslashes (although that is also done for you by the mysql_real_escape_string as far as I'm aware).