title: Best way to sanitise POST/GET variables from a form/URL?
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/60174/best-way-to-stop-sql-injection-in-php">Best way to stop SQL Injection in PHP</a>  </p>
  </blockquote>
  
  
  
  <p>I am creating a website using PHP that makes use of a MySQL database and handles forms and variables from the URL. The variables are being using to dynamically construct SQL query strings. So i need a robust solution to make sure nobody is trying a SQL injection, etc.. A friend of mine has said that really i should only use stored procedures to access the database but that's not really feasible because the host i'm using doesn't allow these.</p>
  
  <p>Here is the code i'm using (it's part of a class to wrap DB commands):</p>
  
  <pre><code>...
  public function Sanitize($Variable)
  {
      if(is_resource($this-&gt;ServerConnection))
      {
          $Variable = str_replace(";", "", $Variable);
          if(get_magic_quotes_gpc())
          {
              if(ini_get('magic_quotes_sybase'))
              {
                  $Variable = str_replace("''", "'", $Variable);
              }
              else
              {
                  $Variable = stripslashes($Variable);
              }
          }
          return mysql_real_escape_string($Variable, $this-&gt;ServerConnection);
      }
      else
      {
          $this-&gt;PrintError("The Sanitize function is not available as there is no server connection.");
      }
  }
  ...
  </code></pre>
  
  <p>Is this function robust enough? Should i be doing anything else?</p>