ktsirig

Hello all,
I want to secure a page which uses the script of "phplist". Basically this script stores username, name, surname, email etc of users in order for the company to send newsletters to their clients.
Except from stripping slashes,backslashes etc or special characters, are there any other ways to prevent the data stored in the db from somenone that wants to "lay their hands" on them?

Thank you!

Jimbo

You should probably use mysql_real_escape_string() and that should mostly cover you from user input.

__________________
<insert disclaimer here>
<insert shameless plug for Visual Studio here>

kruptof

i think there alot of ways to do this...........you could check if they person has actually come from the page that you wanted them to come from....also you could check if(get_magic_quotes_gpc()) is set and if yes then i think you should use strip slashes, then use mysql_real_escape_string, just try to make the perpetrators life a bit harder.

__________________

jsilver608

You may want to use someting like the ADO mysql framework, which allows prepared statements (these can also be more optimized in some situations).

__________________
High Performance PHP
http://www.whenpenguinsattack.com

codetaino

This page gives hints of security issues with php and sql... hope it helps

http://www.sitepoint.com/article/php-security-blunders

__________________
"God bless u all" :)