Take the 2-minute tour ×

I have written this short function to protect against my_sql injection, because of its importance I just want to double check with other's that this will function as I intend.

    $_REQUEST[$key] = stripslashes($value);
    $_REQUEST[$key] = mysql_real_escape_string($_REQUEST[$key]);
share|improve this question
Don't modify the superglobals. They should be left untouched. If you only ever run your own code, it's "ok". but once you start mixing in other libraries, they may expect/require untouched data, and you've now mangled things. –  Marc B Aug 12 '11 at 16:40

6 Answers 6

up vote 9 down vote accepted

Well, you use stripslashes() because the magic_quotes_gpc is set? So this code will only work when magic_quotes_gpc is set! I'd recommend you switch it off and dont use the strislashes() call.

But note there is nothing like "universal sanitization". Let's call it just quoting, because that's what its all about.

When quoting, you always quote text for some particular output, like:

  1. string value for mysql query
  2. like expression for mysql query
  3. html code
  4. json
  5. mysql regular expression
  6. php regular expression

For each case, you need different quoting, because each usage is present within different syntax context. This also implies that the quoting shouldn't be made at the input into PHP, but at the particular output! Which is the reason why features like magic_quotes_gpc are broken (always assure it is switched off!!!).

So, what methods would one use for quoting in these particular cases? (Feel free to correct me, there might be more modern methods, but these are working for me)

  1. mysql_real_escape_string($str)
  2. mysql_real_escape_string(addcslashes($str, "%_"))
  3. htmlspecialchars($str)
  4. json_encode() - only for utf8! I use my function for iso-8859-2
  5. mysql_real_escape_string(addcslashes($str, '^.[]$()|*+?{}')) - you cannot use preg_quote in this case because backslash would be escaped two times!
  6. preg_quote()
share|improve this answer
This answer is most informative to the question. thank you –  Johnny Craig Aug 12 '11 at 16:43
Also it's a good idea to check for data encoding on input. –  Karolis Aug 12 '11 at 16:49
@Karolis, do you mean character encoding? I don't think you need to check input character encoding, if you have everything set properly. –  TMS Aug 12 '11 at 16:59

If you use PDO (properly) you don't have to worry about MySQL injection.


/* Execute a prepared statement by passing an array of insert values */
$calories = 150;
$colour = 'red';
    FROM fruit
$sth->execute(array(':calories' => $calories, ':colour' => $colour));

More information

share|improve this answer
Ive seen this type of coding but never knew the purpose. I will research it so I can begin using it at the start of my next project. Thank you –  Johnny Craig Aug 12 '11 at 16:43
This is THE best way to avoid sql injection. –  Erlend Aug 16 '11 at 15:41

Seems like a bit of sledgehammer approach. You don't need stripslashes unless your running magic_quotes. Type-Casting can be more elegant when you know you want int, float or bool.

Further Info:

Type-Casting: http://php.net/manual/en/language.types.type-juggling.php

testing for magic quotes: http://www.php.net/manual/en/function.get-magic-quotes-gpc.php (Thanks Karolis)

share|improve this answer
can you please link me to a resource with more information on what you propose to do –  Johnny Craig Aug 12 '11 at 16:35
@Johnny if (get_magic_quotes_gpc()) $_REQUEST[$key] = stripslashes($value); –  Karolis Aug 12 '11 at 16:38
@Johnny updated –  Shad Aug 12 '11 at 19:54

you need to explicitly add the database connection identifier into

mysql_real_escape_string(..., $db_connection_identifier);



share|improve this answer
so if my connection is $con = mysql_connect("localhost"... i should add: $_REQUEST[$key] = mysql_real_escape_string($_REQUEST[$key],$con); ? –  Johnny Craig Aug 12 '11 at 16:34
yes, to avoid problem mentioned here stackoverflow.com/questions/1220182/… and stackoverflow.com/questions/4243657/… –  ajreal Aug 12 '11 at 16:35
The syntax diagram says that the link identifier is optional. So unless you have multiple database connections open, you don't really need to add the argument explicitly. –  Barmar Jun 6 at 22:51

If you include arbitrary $keys in your query, you should escape those too.

share|improve this answer
I had not thought of that, I don't do that often. But i am glad you brought that up for the times when I do. –  Johnny Craig Aug 12 '11 at 16:37

Tomas's suggestion is good, but you should always keep them both in mind, so this can be great:

if (get_magic_quotes_gpc()) { // Check if magic quotes are enabled
       $_REQUEST[$key] = stripslashes($_REQUEST[$key])
} else {
      $_REQUEST[$key] = mysql_real_escape_string($value);
share|improve this answer

Your Answer


