Preventing SQL Injection when coding in PHP with MySQL databases

Hi all,

I do a lot of coding for PHP/MySQL based websites (LAMP set-up) and am wondering if you would like to share your best security tips for coding in this platform.

These are some of the checks that I implement now!

• Use of mysql_real_espace_string when pushing user input into queries
• Checking all user input type (is_numeric) etc
• Using sessions to ensure users are logged in and never passing sessions via URL
• Checking user data entered via forms (POST) as well as that entered via URLs (GET)

dfsweb

 

intval() imho is better to use.

Also good security key for forms to prevent xss is handy.