Question

I have a site which allows the user to save images. I sanitize mysql inserts with ‘mysql_real_escape_string’, but someone went and entered a meta with a content redirect in his image description, so that whenever our site loads (loading the latest images as well), it redirects.

How can I sanitize my strings or sql queries to protect against that?

Thanks in advance!

Answer 1

Here is couple of things you can do

1. Use strip_tags()
2. Use mysqli_* function instead of mysql_
3. Use parameterized queries/prepared statments.
4. If possible consider using PHP Frameworks.
5. Convert special character into their respective htmlentities()