Does this "Clear" function prevent SQL injection?

Question

Possible Duplicate:
Best way to prevent SQL Injection in PHP

php get var clear is it good or not plz help me

function Clear($text)
    $Var = str_replace("'", "", $text);
    $Var = str_replace('"', '', $Var);
    $Var = strip_tags($Var);
    $Var = htmlentities($Var);
    return $Var;
}
$_GET['Var'] = "1='1'";
$Var = Clear($_GET['Var']);
$Query = "SELECT * FROM TABLE_NAME WHERE COL ='{$Var}'";
echo 'Result : '.($Query);

it is for SQL injection, this is sample code i wrote iam using pdo. if i using mysql_real_escape_string it dose not working.

I believe the question is whether using the `Clear()` method effectively prevents SQL injection. — , Aug 02 '12 at 06:07
your question is not understandable, kindly clear your problem by editing your question — Salman, Aug 02 '12 at 06:10
Using PDO's `prepare`, *it is already escaped*. It wouldn't be a good idea to double-escape it. — uınbɐɥs, Aug 02 '12 at 07:55

score 5 · Answer 1 · edited May 23 '17 at 12:02

5

NO. NO. NO

That is not "safe" from attacks.

At a bare minimum use mysql_real_escape_string (which is designed for this). The first version, mysql_escape_string, was actually flawed which is why the "real" version exists.

However, I recommend placeholders as a more universal (and tidier) solution.

See How can I prevent SQL injection in PHP? (which I am voting to close as a dupe, as well). The answers cover PDO and prepared statements, among other things.

edited May 23 '17 at 12:02

Community

1
1

answered Aug 02 '12 at 06:08

@user1289782 there is no pdo in your sample code – Ibu Aug 02 '12 at 06:10
I looked at that post and marked this question as an exact duplicate as well, to help :-) Unfortunately, I have reached my voting cap for the day, so I can't upvote... – uınbɐɥs Aug 02 '12 at 08:05

score 2 · Answer 2 · answered Aug 02 '12 at 06:10

2

Use prepared statements: http://php.net/manual/ru/pdo.prepared-statements.php

answered Aug 02 '12 at 06:10

Danil Speransky

29,891
5
68
79

Does this "Clear" function prevent SQL injection?

2 Answers2