how to remove hazardous character in php

Question

I have to remove hazardous chracter from my query post string. Is there any function define in php to remove directly or another way ?

possible duplicate of [Best way to defend against mysql injection and cross site scripting](http://stackoverflow.com/questions/568995/best-way-to-defend-against-mysql-injection-and-cross-site-scripting) — Quentin, Jun 01 '10 at 13:22
You need to define this a little better before we can help you. There are two questions I have 1) What are you doing with the user input - what is 'hazardous' when putting the user's input in HTML is different than what is 'hazardous' when using the input as part of a MySQL query. 2) Where are you getting the user data from? The query string ($_GET), the POST body ($_POST), or somewhere else? — MtnViewMark, Jun 01 '10 at 13:23

score 1 · Answer 1 · answered Jun 01 '10 at 13:39

First thing first what do you use these strings for ?

If you store them in a database : use parameterized queries (use mysqli or PDO instead of mysql).
If you display them in a webpage : use htmlspecialchar to filter HTML code
If you use it to redirect the user to some page : filter \n and \r character
If you use it to send emails : filter \n and \r characters too
If you want to avoid CSRF : don't forget to check the random token you'll have put in your form
If you use it to get the path to a file on your system : don't
Whatever you do, don't forget to use the filter_input function to get your data as it handle the magic_quotes

Don't forget to check the OSWAP top 5

So, I guess that's the result from some security audit, and it got you on some SQL injection. As said, use PDO or mysqli (if your rdbm is Mysql) with parameterized queries. Good luck. — Arkh, Jun 01 '10 at 14:57

score 0 · Answer 2 · answered Jun 01 '10 at 13:23

0

I hope you aren't putting sql queries into a GET string... but whatever.

If this is for a query, use mysql_real_escape_string.

answered Jun 01 '10 at 13:23

Tesserex

score 0 · Answer 3 · answered Jun 01 '10 at 13:28

0

In normally for this, we can use addslashes and stripslashes in php.

But better method is to use mysql_real_escape_string for query to avoid this type of sql injection.

answered Jun 01 '10 at 13:28

Karthik

score 0 · Answer 4 · answered Jun 01 '10 at 13:29

0

Filter the input?

answered Jun 01 '10 at 13:29

jeroen

score 0 · Answer 5 · edited Aug 24 '12 at 15:58

0

Use strip_tags(), htmlspecialchars() and htmlentities().

edited Aug 24 '12 at 15:58

Florent

answered Jun 01 '10 at 13:29

Aziz

5 Answers5