Question

I got this from for a login form tutorial:

function sanitize($securitystring) {
        $securitystring = @trim($str);
        if(get_magic_quotes_gpc()) {
            $securitystring = stripslashes($str);
        }
        return mysql_real_escape_string($securitystring);
    }

Could some one explain exactly what this does? I know that the ‘clean’ var is called up afterwards to sanitize the fields; I.e. $email = sanitize($_POST['email']);

Answer 1

First of all, this code is wrong.
It has wrong meaning and wrong name.

No SQL data preparation code does any cleaning or sanitization.
It does merely escaping. And this escaping must be unconditional.
and escaping shouldn’t be mixed with anything else.

So, it must be three separated functions, not one.

1. Getting rid of magic quotes. Must be done separately at the data input.
2. trim if you wish. It’s just text beautifier, no critical function it does.
3. mysql_real_escape_string() to prepare data for the SQL query.

So, the only mysql related function here is mysql_real_escape_string(). Though it makes no data “clean”, but merely escape delimiters. Therefore, this function must be used only with data what considered as a string and enclosed in quotes. So, this is a good example:

$num=6;
$string='name';
$num=mysql_real_escape_string($num);
$string=mysql_real_escape_string($string);
$query="SELECT * FROM table WHERE name='$name' AND num='$num'";

while this example is wrong:

$num=6;
$string='name';
$num=mysql_real_escape_string($num);
$string=mysql_real_escape_string($string);
$query2="SELECT * FROM table WHERE name='$name' AND num=$num";

Even though $query2 would not throw a syntax error, this is wrong data preparation and mysql_real_escape_string would help nothing here. So, this function can be used only to escape data that treated as a string. though it can be done to any data type, there is some exceptions, such as LIMIT parameters, which cannot be treat as a strings.