Sql db injection (Hack)

[jayra]

Hello please someone tell how to prevent hack using sql db injection ...

Thank's

[MentaL]

[walkernight88]

Use an escape PHP function on website, forum, anything connected to the database.

function escape($Data)
    {
        return str_replace(array("'", '"', "#", "--", "/*", ";", "UPDATE", "DROP", "DELETE"), "", $Data);
    }

How to use it:

$username = escape($_POST[username]);
$password = escape(md5($_POST[password]));
//and so on...

Note: This must be used on input types. It's useless to use it on all variables.
You can use this one, optimize it for your current "infraction" queries.

[Extornia]

Or simply use PDO.