 |
 |
Sounds like you might need something like a SQL version of HTML::Scrubber. The more important thing is to use prepared statements with placeholders, so that you can't get server execution injected on. Then worry about javacript or html scrubbing. -- Joe Atzberger LibLime - Open Source Library Solutions On Fri, Jun 5, 2009 at 10:30 AM, Kenneth R. Irwin <[log in to unmask]>wrote: > Hi folks, > > Can someone point me to some good information/how-to-guide/etc for > sanitizing files uploaded to a MySQL database through a web interface? (This > would be something much like the "Insert data from a textfile into table" > function in phpMyAdmin.) I want to make sure there aren't any nasty queries > inserted into the tab-delimited data. > > I.e., don't let this happen to you: http://xkcd.com/327/ > > Is this whole-file sanitization any different than the sort of thing you > might use for individual pieces of data? E.g. > http://www.denhamcoote.com/php-howto-sanitize-database-inputs > > Any advice would be appreciated. > > Thanks! > Ken >