Function to sanitize input values PHP

Question

I use this:

function safeClean($n)
{
    $n = trim($n);

    if(get_magic_quotes_gpc())
    {
        $n = stripslashes($n);
    } 

    $n = mysql_escape_string($n);
    $n = htmlentities($n);

    return $n;
}

To prevent any type of MySQL injection or anything like that. Whenever I use it to wrap around $_POST like this:

$username = safeClean($_POST['user']);
$password = md5(safeClean($_POST['password']));
$vpassword = md5(safeClean($_POST['verify']));
$email = safeClean($_POST['email']);

It doesn't even work, but I have attached functions.php and the directory is correct but doesn't work at all because it just shows a blank page... If I remove the safeClean() from each $_POST it works.

How come this isn't working at all?

Answer 1

Try using mysql_real_escape_string() rather than mysql_escape_string().

Answer 2

In my opinion, this sort of general sanitization approach isn't the best way to think about things. For one thing, parameterized queries (probably most convenient using PDO) are a much better way to approach the SQL safety issue. But in general...

I know the developer impulse is to try and reduce the number of things you have to think about. So, naturally, you want to see if you can come up with an all-purpose sanitization function you can just hand all inputs over to and not have to worry any more. Inputs are one arena, though, where if you really want security, you need to think specifically about what each incoming piece of data is supposed to be and where it's going to end up. If you go on auto-pilot here, you will introduce a security issue at some point.

Answer 3

Almost everything in your code is wrong.

get_magic_quotes_gpc is misplaced, htmlentities is misplaced and even term "sanitization" is misused.

As a matter of fact, you shouldn't sanitize anything for the database. But just follow syntax rules.
Take a look at the very similar question, I've explained SQL matters pretty well: http://stackoverflow.com/questions/2993027/in-php-when-submitting-strings-to-the-db-should-i-take-care-of-illegal-characters

And as of the blank page, you have to learn primer of debugging. You have to turn error reporting on to see error messages instead of blank page. To start with it you can refer to this article: Link to start: http://www.ibm.com/developerworks/library/os-debug/

you can start from adding these lines at the top of your cript

ini_set('display_errors',1);
error_reporting(E_ALL);

and this code to the query execution:

$result = mysql_query($query);
if (!$result) trigger_error(mysql_error());