
Originally Posted by
rhys918
can you show me how to by the way its P-Team who hacks me for no reason
Sigh, just use this function:
Code:
function antisql( $data )
{
$data = str_replace( "'", "''", $data );
$data = htmlentities( $data );
return( $data );
}
XSS and SQL injection, for the most part, isn't possible in this setup; unless your queries don't use quotes (I haven't seen anyone do that yet, as it's pointless), or unless you take data from the database and enter that as an attribute in an HTML tag, and said data is modifiable by the user, then you're safe.