How to avoid php hacks?

[nick3592]

hi i would like to know what steps you guys take to avoid php hacks such as sql injection, xss hacks.

[vibhaJ]

This is a php function to avoid sql injection.

<?
function cleanQuery($string)
{
  if(get_magic_quotes_gpc())  // prevents duplicate backslashes
  {
  	$string = stripslashes($string);
  }
  if(phpversion() >= '4.3.0')
  {
    $string = mysql_real_escape_string($string);
  }
  else
  {
    $string = mysql_escape_string($string);
  }
  return $string;
}

// if you are using form data, use the function like this:
if (isset($_POST['itemID'])) $itemID = cleanQuery($_POST['itemID']);

// you can also filter the data as part of your query:
$sql = "SELECT * FROM items WHERE itemID = '".  cleanQuery($itemID)."'";

?>