Re:46 useful PHP code snippets
by kodablah on Thursday August 06, 2015 @11:40AM
(#10017205)
I stopped at #3...using stripslashes is not an acceptable deterrent by any means. I am also unsure how htmlentities has anything to do with SQL injection...maybe you meant XSS prevention? I chose not to read the rest.
[ Parent
| on HN ]
You chose wisely. What is this _thing_ doing here?
Many snippets are of questionable quality. Also, any decent programmer should be able to come up with all of them and implement them more cleanly.
Oh, and please people, don't use snippets like those without checking the services first (in the case of the emails, SMS). Just go to the page of the company offering the service, read the documentation AND also read the terms of service.
Jeesh.
Re:46 useful PHP code snippets
by midnightmonster on Thursday August 06, 2015 @11:52AM
(#10017322)
The title and description don't match the code there. As you say, the code sample is actually to prevent XSS, not SQL injection.
stripslashes is used to undo the effects of PHP's old, terrible magic quotes misfeature, b/c the original author (probably not the blog post author) is assuming that $input is coming from the user via GET or POST.
100% agreed, I have the same sentiment. In the year 2015, everyone should know about injections and how to use prepared statements and similar insertion mechanisms that clearly separate query from data. A big no-no to solve anything with the presented function.
Yeah, just logged in to say that. Author probably never heard of PDO and parametrized queries...
If he ever visit this page, some not too outdated articles about PHP:
http://www.phptherightway.com/ http://fabien.potencier.org/php-is-much-better-than-you-thin...
In addition to stripslashes being woefully inadequate, the vast majority of these are demonstrations of cURL + some API. The PHP aspect is tertiary.