Is it necessary or advisable to remove certain characters from strings in addition to using mysql_real_escape_string to prevent SQL injections?

To prevent SQL injections, it is crucial to use mysql_real_escape_string to escape special characters that could be used in SQL queries to manipulate the database. However, it is also advisable to remove certain characters that could potentially be harmful, such as semicolons, quotes, and backslashes. This extra step adds an additional layer of security to protect against potential attacks. 

// Assuming $conn is the database connection
$input = $_POST['input']; // Assuming input is the user input data

// Remove potentially harmful characters
$input = str_replace(array(';', "'", '"', '\\'), '', $input);

// Escape the input using mysql_real_escape_string
$input = mysql_real_escape_string($input);

// Use the sanitized input in your SQL query
$query = "INSERT INTO table_name (column_name) VALUES ('$input')";
$result = mysql_query($query, $conn);

Keywords

PHP mysql_real_escape_string SQL injection character filtering security

Related Questions