If you're using PHP5, you might consider using the [man]PDO[/man] extension as its drivers do all of the injection-prevention for you (as well as providing more functionality than the older, deprecated [man]MySQL[/man] extension). As for your questions...
daredevil14 wrote:so what's up with the stripslashes() function ? what's it all about ? do i have to always use it with mysql_real_escape_string() ?
Simply put, you should never have to use stripslashes() in combination with mysql_real_escape_string(). The only time you would need to do so is if magic_quotes_gpc is enabled, in which case you'd do something like:
if(get_magic_quotes_gpc()) {
$var = mysql_real_escape_string(stripslashes($_POST['var']));
} else {
$var = mysql_real_escape_string($_POST['var']);
}
While the above code snippet would maintain the portability of your script, you should make every effort to ensure that magic_quotes_gpc is disabled on your server.
daredevil14 wrote:How can i test the mysql_real_escape_string() to know its effect and its main solution of SQL injections ?
I don't know what you mean by "test"... as the manual for [man]mysql_real_escape_string/man explains, the function simply prepends certain characters that would normally cause problems in a SQL query with a backslash so that their special meanings are canceled (e.g. a single quote is prepended with a backslash to prevent SQL injections - malicious users can't escape out of a string and add their own commands into the SQL query).
daredevil14 wrote:*Is it sufficient to use the mysql_real_escape_string() function only to protect from SQL injenctions ? does it provide an acceptable security level ?
For SQL injection prevention alone, yes, it will stop users from altering your query.
There are also other methods of preventing SQL injection, e.g. validating the type of data. For example, if you're expecting a variable $_GET['user_id'] to be a number, you can either cast it to an integer, use [man]intval[/man], use '%d' in a [man]sprintf/man format string, etc. Such measures negate the need to use [man]mysql_real_escape_string/man.
daredevil14 wrote:*What about the regular expressions & filters ( stuffs like , [a-z]... ) ? should they be used with the mysql_real_escape_string() function ?
Regexp patterns should have nothing to do with SQL injection prevention. Instead, you should be using regexp pattersn to verify the format (or type) of the data (e.g. ensure that it begins with a letter, is between 3-16 characters long, etc. etc.).
In other words, yes, you can of course use regexp's if you want to verify that the data is in the correct format. Using it to prevent SQL injection, however, is overkill, inefficient, and completely unnecessary.
