sql injection

Hi
I usually use mysql_real_escape_string($_POST['field']) to avoid sql injection
But this time The form inputs contains single quotes and when I use mysql_real_escape_string it adds a lot of \\\ to the input. It causes problems. In addition I noticed $_POST adds a \ before single quotes, maybe I don't need mysql_real_escape_string anymore?

Any idea?
Thanks in advance

 

Its probably because magic quotes is enabled, instead of using mysql_real_escape_string() use the following function; clean().

<?php
function clean($input) {
$input = trim($input);
$input = get_magic_quotes_gpc() ? stripslashes($input) : $input;
if (!is_numeric($input)){
//prevent sql injection...
$input = mysql_real_escape_string($input);
}
return $input;
}

//example usage
$field  = clean($_POST['field']);
?>

PHP:

or if you have php.ini access set magic_quotes_gpc to Off, so php.ini should look like (or contain):

magic_quotes_gpc = Off

Code (markup):

 

Use PDO/prepared statements for SQL. Don't directly query.

 

Use intval function for numeric inputs before you apply in query.

 

Do not query at all. Use prepared statements.