ereg format to prevent SQL injection

[shartken]

I am trying to run the following function to prevent sql injection in the body of a forum message:

<?php
ereg((SELECT\s[\w\*\)\(\,\s]+\sFROM\s[\w]+)|
(UPDATE\s[\w]+\sSET\s[\w\,\'\=]+)|
(INSERT\sINTO\s[\d\w]+[\s\w\d\)\(\,]*\sVALUES\s\([\d\w\'\,\)]+)|
(DELETE\sFROM\s[\d\w\'\=]+), "SELECT * FROM table");
?>

But nothing happens. What I want to do is censor out SQL commands in a message body. I can't just take out words like SELECT or DELETE as they might be used legitamately. So I came up with this idea.
If someone has an easier away around SQL injection in a forum, just let me know.

 

[Olavxxx]

uhm, what about using:

http://no2.php.net/mysql_real_escape_string

If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks.

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[shartken]

Thanks.

 

[shartken]

Wait, I am using PHP v3 and I can't run this function. If magic quotes are turned on, do I even need to do this. Or should I just use the strip_slashes functioN?

 

[Olavxxx]

I think maybe you can ask your hosting company if they want to update the version of php they are running?

if not, read up here:

http://no2.php.net/manual/en/function.stripslashes.php

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[Bastien]

what about using htmlentities as well to avoid js scrpting attacks on the db?

Bastien

Cat, the other other white meat