I would like to know which is stronger filter_var or mysqli_real_escape_string.  To be more specific.  Option1:  //Course Title $ctitle = trim($_POST['courseTitle']); $clean_ctitle = filter_var($ctitle, FILTER_SANITIZE_STRING);   Option2:  //Course Title $ctitle = trim($_POST['courseTitle']); $clean_ctitle = mysqli_real_escape_string($con, $ctitle);   I also know about prepared statements but I want to filter the data coming in before hand. If there is an alternative, let me know.
17730
Is there a catchall function somewhere that works well for sanitizing user input for SQL injection and XSS attacks, while still allowing certain types of HTML tags?
10097
Does Java have a built-in way to escape arbitrary text so that it can be included in a regular expression? For example, if my users enter "$5", I'd like to match that exactly rather than a "5" after the end of input.
103530
I'm wondering if there is a "best" choice for collation in MySQL for a general website where you aren't 100% sure of what will be entered? I understand that all the encodings should be the same, such as MySQL, Apache, the HTML and anything inside PHP.  In the past I have set PHP to output in "UTF-8", but which collation does this match in MySQL? I'm thinking it's one of the UTF-8 ones, but I have used utf8_unicode_ci, utf8_general_ci, and utf8_bin before.
9044
I am coding in ColdFusion, but trying to stay in cfscript, so I have a function that allows me to pass in a query to run it with   &lt;cfquery blah >   #query# &lt;/cfquery>   Somehow though, when I construct my queries with sql = "SELECT * FROM a WHERE b='#c#'"  and pass it in, ColdFusion has replaced the single quotes with 2 single quotes.  so it becomes  WHERE b=''c'' in the final query.  I have tried creating the strings a lot of different ways, but I cannot get it to leave just one quote.  Even doing a string replace has no effect.   Any idea why this is happening?  It is ruining my hopes of living in cfscript for the duration of this project
34548
I'm trying to make a class that will execute any one of a number of stored procedures with any amount of variables  Im using php and mysqli   My class enumerates an array and constructs a string based on the number of elements if any giving something like this CALL spTestLogin(?,?) for example I now need to bind the input from my array using somethin like this:  $stmt->bind_param($this->paramTypes,$this->paramValues);//paramValues is my array   Then if that works I can work on getting my results  Any ideas
23809
How do I escape the underscore character?  I am writing something like the following where clause and want to be able to find actual entries with _d at the end.  Where Username Like '%_d'
28714
I am trying to understand variable_get(). I read so far that you can set variables in the settings.php using the $conf array and retrieve them later in code by using variable_get(). I have read that you can also use variable_get() to retrieve values from the database.   How does this work? Is there a table that is automatically built? How would you set variables if this feature is possible?
91753
In a mysqli prepared statement, a NULL gets turned into '' (in the case of a string) or 0 (in the case of an integer). I would like to store it as a true NULL.  Is there any way of doing this?
12526
Would you recommend using a  or a  field, and why (using MySQL)?   I'm working with PHP on the server side.
58950
In views I can add PHP snippets for custom validation or when I want to provide default value for contextual filter. It is telling me that I can use $view or $argument - but where is documentation of these objects? Where can I read what are my possibilities in these areas (or how check this, by using debugger for example)?
15365
In Perl, what is a good way to perform a replacement on a string using a regular expression and store the value in a different variable, without changing the original?  I usually just copy the string to a new variable then bind it to the s/// regex that does the replacement on the new string, but I was wondering if there is a better way to do this?  $newstring = $oldstring; $newstring =~ s/foo/bar/g;
114332
I have the problem, that PHP replaces all spaces with underscores in POST and GET variables. For example if I have the URL: http://localhost/proxy.php?user name=Max the browser will convert it to http://localhost/proxy.php?user%20name=Max. But if I give the $_GET parameters out, the key is not user name but user_name (note the underscore)! Is there any possibility to change this behaviour?
74148
Does anyone know of a program, a utility, or some programmatic library, preferably for Linux, that takes an unformatted SQL string and pretty prints it?  For example I would like the following  select * from users where name = 'Paul'   be changed to something like this  select *  from users where    name = 'Paul'   The exact formatting is not important. I just need something to take a large SQL string and break it up into something more readable.
17495
I have the following code:  $countQuery = "SELECT ARTICLE_NO FROM ? WHERE upper(ARTICLE_NAME) LIKE '% ? %'"; if ($numRecords = $con-&gt;prepare($countQuery)) {     $numRecords-&gt;bind_param("ss", $table, $brand);     $numRecords-&gt;execute();     $data = $con-&gt;query($countQuery) or die(print_r($con-&gt;error));     $rowcount = mysql_num_rows($data);     $rows = getRowsByArticleSearch($query, $table, $max);     $last = ceil($rowcount/$page_rows); }   Which should work fine. However I receive the error that :  You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '? WHERE upper(ARTICLE_NAME) LIKE '%?%'' at line 1  If I put  SELECT ARTICLE_NO FROM AUCTIONS WHERE upper(ARTICLE_NAME) LIKE '% o %';   The query works fine. $table is defined above, and query is received from GET, and both are correct valid values. Why is this failing?  edit: changing to:  $countQuery = "SELECT ARTICLE_NO FROM AUCTIONS1 WHERE upper(ARTICLE_NAME) LIKE '% ? %'";  if ($numRecords = $con-&gt;prepare($countQuery)) {      $numRecords-&gt;bind_param("s", $query);   results in the error:   Warning: mysqli_stmt::bind_param() [mysqli-stmt.bind-param]: Number of variables doesn't match number of parameters in prepared statement in C:\Program Files\EasyPHP 3.0\www\prog\get_records.php on line 38  Commands out of sync; you can't run this command now  where as   $countQuery = "SELECT ARTICLE_NO FROM AUCTIONS1 WHERE upper(ARTICLE_NAME) LIKE ?";  if ($numRecords = $con-&gt;prepare($countQuery)) {      $numRecords-&gt;bind_param("s", "%".$query."%");   results in  Fatal error: Cannot pass parameter 2 by reference in C:\Program Files\EasyPHP 3.0\www\prog\get_records.php on line 38  and lastly  $countQuery = "SELECT ARTICLE_NO FROM AUCTIONS1 WHERE upper(ARTICLE_NAME) LIKE ? ";  if ($numRecords = $con-&gt;prepare($countQuery)) {      $numRecords-&gt;bind_param("s", $query);   will give only:  Commands out of sync; you can't run this command now  Is it impossible to use a paramter for a LIKE statament?
20284
I'm supposed to test a web application for SQL injections. I'm new to this type of security testing and I'd like to get some tips on the matter. Are there any best practices or do I simply search on the Internet for the most common SQL injections and try them out on my application?  I hope some guidance would be profitable for other newbies like me, so please, help me complete the following lists:   List of "places" in the application to be tested:   username  password(s)  e-mail search field  text fields any other fields that are available to the user  List of tests to be performed:   ...?    Thanks!
61016
I realize that parameterized SQL queries is the optimal way to sanitize user input when building queries that contain user input, but I'm wondering what is wrong with taking user input and escaping any single quotes and surrounding the whole string with single quotes. Here's the code:  sSanitizedInput = "'" &amp; Replace(sInput, "'", "''") &amp; "'"   Any single-quote the user enters is replaced with double single-quotes, which eliminates the users ability to end the string, so anything else they may type, such as semicolons, percent signs, etc., will all be part of the string and not actually executed as part of the command.    We are using Microsoft SQL Server 2000, for which I believe the single-quote is the only string delimiter and the only way to escape the string delimiter, so there is no way to execute anything the user types in.  I don't see any way to launch an SQL injection attack against this, but I realize that if this were as bulletproof as it seems to me someone else would have thought of it already and it would be common practice.    What's wrong with this code? Is there a way to get an SQL injection attack past this sanitization technique?  Sample user input that exploits this technique would be very helpful.    UPDATE:  I still don't know of any way to effectively launch a SQL injection attack against this code. A few people suggested that a backslash would escape one single-quote and leave the other to end the string so that the rest of the string would be executed as part of the SQL command, and I realize that this method would work to inject SQL into a MySQL database, but in SQL&nbsp;Server 2000 the only way (that I've been able to find) to escape a single-quote is with another single-quote; backslashes won't do it.  And unless there is a way to stop the escaping of the single-quote, none of the rest of the user input will be executed because it will all be taken as one contiguous string.  I understand that there are better ways to sanitize input, but I'm really more interested in learning why the method I provided above won't work. If anyone knows of any specific way to mount a SQL injection attack against this sanitization method I would love to see it.
41834
Has anybody used a good obfuscator for PHP? I've tried some but they don't work for very big projects. They can't handle variables that are included in one file and used in another, for instance.  Or do you have any other tricks for stopping the spread of your code?