One more thing, should I use @ for security purpose or not so that the use
can reply me with the errors so that I can troubleshoot the problem more
---------- Forwarded message ----------
From: Ashley Sheridan <a...@ashleysheridan.co.uk>
Date: Thu, May 21, 2009 at 6:36 PM
Subject: Re: [PHP] SECURITY PRECAUTION BEFORE SUBMITTING DATA IN DATABASE
To: Sumit Sharma <sumitp...@gmail.com>
On Thu, 2009-05-21 at 18:22 +0530, Sumit Sharma wrote:
> I am designing a php website for my client which interact with database.
> This is my first project for any client (I hope he is not reading this
> ;-) ). I am a bit more concerned with database security. Can somebody
> some light on the security measurements, precautions, and functions
> to database security in general to make sure that the data is safely
> updated and retried from database. I have already used htmlentities(),
> strip_tags(), addhashes(), and some regular expressions to check security.
> Looking for help beyond this.
> Thanks in advance...
I'd advise using something like mysql_real_escape_string() (assuming you
are using a MySQL database that is) on each variable of data before you
insert it into the database. You could go further and validate specific
data, so check that a field which you expect a number only contains a