Sounds like you might need something like a SQL version of HTML::Scrubber.
The more important thing is to use prepared statements with placeholders, so
that you can't get server execution injected on. Then worry about javacript
or html scrubbing.
LibLime - Open Source Library Solutions
On Fri, Jun 5, 2009 at 10:30 AM, Kenneth R. Irwin <[log in to unmask]>wrote:
> Hi folks,
> Can someone point me to some good information/how-to-guide/etc for
> sanitizing files uploaded to a MySQL database through a web interface? (This
> would be something much like the "Insert data from a textfile into table"
> function in phpMyAdmin.) I want to make sure there aren't any nasty queries
> inserted into the tab-delimited data.
> I.e., don't let this happen to you: http://xkcd.com/327/
> Is this whole-file sanitization any different than the sort of thing you
> might use for individual pieces of data? E.g.
> Any advice would be appreciated.