addslashes

Possible Duplicate: What does mysql_real_escape_string() do that addslashes() doesn't? I have been reviewing articles on how/why PHP's addslashes function is vulnerable to sql injection. Everything I have read says there are problems with specific mysql encoding types (default-character-set=GBK), or there are problems if magic_quotes are enabled. However, I have been unable break out of the addslashes() function in this scenario and do something malicious - such as login as an administrator. $user = addslashes($_POST['user']); $pass = sha1($_POST['pass']); $sql = "SELECT * FROM admins WHERE

I've been doing some reading on securing PHP applications, and it seems to me that mysqli_real_escape_string is the correct function to use when inserting data into MySQL tables because addslashes can cause some weird things to happen for a smart attacker. Right? However, there is one thing that is confusing me. I seem to remember being advised addslashes is better than htmlentities when echoing user-entered data back to users to protect their data, but it seems like addslashes is the one with the vulnerability. Is this true, or am I remembering incorrectly? There are different contexts for

一、几个与特殊字符处理有关的PHP函数 函数名 释义 介绍 htmlspecialchars 将与、单双引号、大于和小于号化成HTML格式 &转成& "转成" ' 转成' <转成< >转成> htmlentities() 所有字符都转成HTML格式 除上面htmlspecialchars字符外，还包括双字节字符显示成编码等。 addslashes 单双引号、反斜线及NULL加上反斜线转义 被改的字符包括单引号 (')、双引号 (")、反斜线 backslash (\) 以及空字符NULL。 stripslashes 去掉反斜线字符 去掉字符串中的反斜线字符。若是连续二个反斜线，则去掉一个，留下一个。若只有一个反斜线，就直接去掉。 quotemeta 加入引用符号 将字符串中含有 . \\ + * ? [ ^ ] ( $ ) 等字符的前面加入反斜线 "\" 符号。 nl2br() 将换行字符转成<br> strip_tags 去掉HTML及PHP标记 去掉字符串中任何 HTML标记和PHP标记，包括标记封堵之间的内容。注意如果字符串HTML及PHP标签存在错误，也会返回错误。 mysql_real_escape_string 转义SQL字符串中的特殊字符 转义 \x00 \n \r 空格 \ ' " \x1a，针对多字节字符处理很有效。mysql_real_escape

Possible Duplicate: mysql_real_escape_string VS addslashes If they don't do exactly the same, what's the difference? The delimiter for values inside a MySQL query is the ' isn't it? Or maybe the " but that's also escaped with addslashes. In other database engines I understand (and definitely inside a db wrapper like PDO), but why are so many people so adament on using mysql(i)_escape_string instead of addslashes? Jon First of all: do not use mysql_escape_string , it is deprecated (for a reason)! If you have to support a legacy application that connects to the database through the mysql

lets imagine a form editor, it can edit available values. If the data contains " character (double quote) it "destroys" HTML code. I meant, lets check the code: so I generate HTML: onclick="var a = prompt('New value: ', '<?php echo addslashes($rec[$i]); ?>'); if (a != null).... and it results in onclick="var a = prompt('New value: ', 'aaaa\"aaa'); if (a != null) { v.... and this makes JS work impossible, so that it ruins the code. With single qoute ' it works OK. mysql real escape does the same. How to escape any string so that it won't ruin javascript? json_encode looked OK, but I must be

This question already has an answer here: Single and double quotes together as HTML attribute value? 2 answers For a variable inside a echo that contains HTML, where would I add slashes to escape the double quotes? Example: echo "<input type=\"hidden\" name=\"id\" value=".$row['id']." />"; This part: value=".$row['id']." Ja͢ck Some tips on outputting HTML with PHP: Use single quotes so that you don't have to escape the double quotes (when using echo), Use htmlspecialchars() to properly escape any "rogue" values you may have. Example using echo : echo '<input type="hidden" name="id" value="',