Question

I have this following code below. What can I do to get it to include special allowed (those that won’t comprimise db because of injections) characters like: !@#%&*

$random_id_length = 5; 


$rnd_id = crypt(uniqid(rand(),1)); 


$rnd_id = strip_tags(stripslashes($rnd_id)); 


$rnd_id = str_replace(".","",$rnd_id); 
$rnd_id = strrev(str_replace("/","",$rnd_id)); 

$rnd_id = substr($rnd_id,0,$random_id_length); 

Answer 1

Couldn’t you just call mysql_real_escape_string() to escape the characters into MySQL safe characters?

Edit

You could further escape characters in this manner: http://php.net/manual/en/function.preg-replace.php#example-3967

OR

Following the format shown in this MySQL article on proper PHP coding for security (particularly page 78 and 79), you can use the following as a way to escape it fully.
http://dev.mysql.com/tech-resources/articles/guide-to-php-security-ch3.pdf

$sub = addcslashes(mysql_real_escape_string("%something_"), "%_");
// $sub == \%something\_