PHP sql对待特殊字符

Question

$sql = "INSERT INTO golf (datum, odkud, odjezd ) VALUES ('$datum', '$odkud', '$odjezd')";
if(!mysqli_query($connection,$sql)) {
echo '<p class="error">Záznam nebyl vložen</p>';
} else {
header ("location :/golf");
}

Hello, I am working on my thesis to school. I have this code and my supervisor keeps telling me to "treat special characters". How do I do that? He only saw the code I showed you.

Answer 1

User input MUST be sanitized prior to insertion, you'll be opening a door into your server otherwise.
You also need to validate the input. What I normally do, is create a series of regex to validate each field individually, or use one of the available php validate filters .
Remember, you can - and should - do client side validation , which is great to reduce server load, but has 0 value as a security measure because it can be easily faked. server side validation is the most important as it's your last line of defense .
Don't take user input lightly, tons of servers get hacked due to bad or nonexistent user input sanitization.

---

To directly answer your question, mysqli_real_escape_string() is your friend to escape special characters , ie:

$odjezd = mysqli_real_escape_string($connection, $odjezd)

---

Characters encoded are NUL (ASCII 0), \\n, \\r, \\, ', ", and Control-Z.

---

Update:

I have used mysqli_real_escape_string and i am still able to submit "a{b}c'=%" I would like it to remove spec.characters and just input abc...how?

Let's assume that $odkud can only contain letters or digits and be 5 chars long only to validate, we can use preg_match() as validator, ie:

$id  = $_REQUEST['id']; 
if (preg_match('/^[a-z\d]{5}$/i', $odkud)) {
    # Successful match
} else {
    # Match attempt failed
}

Live Regex Example & Explanation

---

If you just need to remove the special characters use one of the php filters mentioned above or preg_replace , ie:

$odkud_filtered = preg_replace('/[^a-z\d]/i', '', $odkud);
# abc

Live Regex Example & Explanation

Answer 2

your supervisor just ask you to treat special characters 😊. For that @Pedro's answer is enough.

$odjezd = mysqli_real_escape_string($connection, $odjezd)     // copied from @Pedro’s answer

But if you need more validation, you can check the format of the date is correct?

$test_arr  = explode('/', $POST[‘date’]);
if (count($test_arr) == 3) {
    if (checkdate($test_arr[0], $test_arr[1], $test_arr[2])) {
        // valid date ...
    } else {
        // problem with dates ...
    }
} else {
    // problem with input ...
}

Likewise you can validate your data according to your required way.

this might be helpful.