3 ms·

I stopped at #3...using stripslashes is not an acceptable deterrent by any means. I am also unsure how htmlentities has anything to do with SQL injection...mayb

I stopped at #3...using stripslashes is not an acceptable deterrent by any means. I am also unsure how htmlentities has anything to do with SQL injection...maybe you meant XSS prevention? I chose not to read the rest.

M4v3R 11y ago
Yeah, just logged in to say that. Author probably never heard of PDO and parametrized queries...
- agumonkey 11y ago
  If he ever visit this page, some not too outdated articles about PHP: http://www.phptherightway.com/ http://www.phptherightway.com/ http://fabien.potencier.org/php-is-much-better-than-you-think.html http://fabien.potencier.org/php-is-much-better-than-you-thin...
agumonkey 11y ago
Oh wow. So happy not having to read such things anymore.
Kenji 11y ago
100% agreed, I have the same sentiment. In the year 2015, everyone should know about injections and how to use prepared statements and similar insertion mechanisms that clearly separate query from data. A big no-no to solve anything with the presented function.
nkozyra 11y ago
In addition to stripslashes being woefully inadequate, the vast majority of these are demonstrations of cURL + some API. The PHP aspect is tertiary.
kolme 11y ago
You chose wisely. What is this _thing_ doing here? Many snippets are of questionable quality. Also, any decent programmer should be able to come up with all of them and implement them more cleanly. Oh, and please people, don't use snippets like those without checking the services first (in the case of the emails, SMS). Just go to the page of the company offering the service, read the documentation AND also read the terms of service. Jeesh.
midnightmonster 11y ago
The title and description don't match the code there. As you say, the code sample is actually to prevent XSS, not SQL injection. stripslashes is used to undo the effects of PHP's old, terrible magic quotes misfeature, b/c the original author (probably not the blog post author) is assuming that $input is coming from the user via GET or POST.

M4v3R 11y ago

Yeah, just logged in to say that. Author probably never heard of PDO and parametrized queries...

agumonkey 11y ago
If he ever visit this page, some not too outdated articles about PHP: http://www.phptherightway.com/ http://www.phptherightway.com/ http://fabien.potencier.org/php-is-much-better-than-you-think.html http://fabien.potencier.org/php-is-much-better-than-you-thin...

agumonkey 11y ago

Oh wow. So happy not having to read such things anymore.

Kenji 11y ago

100% agreed, I have the same sentiment. In the year 2015, everyone should know about injections and how to use prepared statements and similar insertion mechanisms that clearly separate query from data. A big no-no to solve anything with the presented function.

nkozyra 11y ago

In addition to stripslashes being woefully inadequate, the vast majority of these are demonstrations of cURL + some API. The PHP aspect is tertiary.

kolme 11y ago

You chose wisely. What is this _thing_ doing here? Many snippets are of questionable quality. Also, any decent programmer should be able to come up with all of them and implement them more cleanly. Oh, and please people, don't use snippets like those without checking the services first (in the case of the emails, SMS). Just go to the page of the company offering the service, read the documentation AND also read the terms of service. Jeesh.

midnightmonster 11y ago

The title and description don't match the code there. As you say, the code sample is actually to prevent XSS, not SQL injection. stripslashes is used to undo the effects of PHP's old, terrible magic quotes misfeature, b/c the original author (probably not the blog post author) is assuming that $input is coming from the user via GET or POST.