can this function prevent sql injection and xss?

Question

 function clean( $value ) {

        if(function_exists( "mysql_real_escape_string" ) ) {

            if( get_magic_quotes_gpc() ) { $value = stripslashes( $value ); }
            $value = mysql_real_escape_string( $value );
        } else { 


            if( !get_magic_quotes_gpc() ) { $value = addslashes( $value ); }

        }

    $value = strip_tags($value);
    $value = htmlentities( $value, ENT_QUOTES, 'utf-8' );
    $value = htmlspecialchars( $value , ENT_QUOTES , 'utf-8' );

        return $value;
    }


if(isset($_GET))
{
    foreach($_GET as $k=>$v)
    {
        echo clean($v);
    }
}

when i try

http://localhost/test.php?act=add_credit&rid=975&total=%22%20onmouseover%3dprompt%28929649%29%20bad%3d%

i see

 add_credit975" onmouseover=prompt(929649) bad=%

it means onmouseover=prompt(929649) gets trough ... as stupid as it sound i dont have direct access to that website ... someone just gave me a webpage and asked me to make it safe .

and using pdo , prepared statements , sqli and ..... are out of question

Duplicate of [the-ultimate-clean-secure-function](http://stackoverflow.com/questions/4223980/the-ultimate-clean-secure-function) — Your Common Sense, May 11 '13 at 19:39

score 0 · Answer 1 · answered May 11 '13 at 19:40

0

can this function prevent sql injection and xss ?

No.

answered May 11 '13 at 19:40

Your Common Sense

156,878
40
214
345

score 0 · Accepted Answer · answered May 11 '13 at 19:40

0

No, it's not, and SQL injection != XSS.

You need to escape data to prevent SQL injection before you insert it in the database. I suggest you use PDO and prepared statements instead of *_real_escape_string.

To prevent XSS exploits, escape your data before sending it to the screen as HTML. Usually you do this after you get it from the database. In most cases strip_tags and htmlspecialchars are enough. Examples:

<p> <?= $untrustedData; ?> </p>                      <!-- <- strip tags -->
<a name="<?= $untrustedData; ?>"> trusted data </a>  <!-- <- htmlspecialchars -->

answered May 11 '13 at 19:40

nice ass

16,471
7
50
89

thanx , i didn't say sqlinjection == xss ! .... anyway first part of clean function (almost 9 lines ) is to scape data are you saying that won't do it ? – max May 11 '13 at 19:46
1

I'm saying that choosing the right filter depends on the context. There's no magic function that's right for every situation – nice ass May 11 '13 at 19:48

can this function prevent sql injection and xss?

2 Answers2