Need Security Tips php/mysql

[Anon]

Can anyone point me to an online article, or text describint how I should filter "form input" and/or uploads via php/mysql? I want to create some interactive content, but don't want to accidentally create a security breach or allow anything that would cause havoc with a mysql database.

Thanks for any and all clues or resource tips,

Ranyart

[[deleted]]

Off the top of my head:

• Don't EVER allow users to enter queries to be executed on your database.
• Limit the access of your webserver on mysql. use the GRANT statement to revoke the create, drop and alter privileges from your webservers mysql-account.
• Filter each and every query, to make sure that there is a WHERE clause in every statement that has a DELETE command in it. Preferable also filter that in the where clause, there is nothing like 'WHERE 1' or 'WHERE 1=1', or any other clause that would delete all records.
• In form data, use 'htmlspecialchars' and 'htmlentities' to translate html tags
  into harmless html entities. This stops people from uploading javascripts that can mess up other user's browsers.