A sanitize function was added to prevent SQL injection by stripping certain characters. It sure is hard to manually go through all the files and find where the function should be added. Is there a way to automate this process or use find/replace? What I’m currently doing is looking for SELECT, UPDATE or INSERT statements and inside them I look for #...# and replace it with #sanitize(...)# but it may be more complicated if there are multiple columns being updated in a table.
EDIT: can grep be used? If you don’t know the answer please consider voting this question up.
sql injection can take place in a SELECT call as well as any other sql call. Not just UPDATE and INSERT.