5 ms·
PHP contains filters for a reason. They are there to protect you. While this was a clever challenge, in general you should sanitize all of your input using fil
by sh1mmer 16y ago
PHP contains filters for a reason. They are there to protect you.
While this was a clever challenge, in general you should sanitize all of your input using filters.
- getsat 16y agoIn general, you should not use PHP, but, If you must, you should be using a framework that handles this kind of stuff for you. Input sanitisation has been solved thousands of times by people smarter than you. Do not reinvent the wheel (poorly).
- pornel 16y agoFiltering of input is not appropriate way of ensuring that SQL queries are safe, e.g. you'd be telling people named "O'Hara" that they're not SQL-compatible or you'll fall into magic_quotes trap. You should escape output. In this case there isn't anything wrong with the input, and you can't say that any byte of MD5 is wrong or dangerous. It's just data that is used improperly. Binary data in SQL queries is especially tricky, because strings may be expected to be in specific character encoding (e.g. UTF-8), so you either need to use prepared statements and pass argument explicitly as binary, or use string-safe escaping (e.g. hex).
- konad 16y agomagic_quotes is turned off by default for a reason too.