Reacties op de tutorial Beveiliging in scripts

<?php
mysql_connect('localhost', '', '');
mysql_select_db('');
$id = stripslashes($_GET['id']); // magic_quotes staat aan bij mij..
$sql = mysql_query("SELECT * FROM `2l2d_users` WHERE `usr_id` = '".$id."'");
while($arr = mysql_fetch_assoc($sql)) {
	echo $arr['usr_nick'].'<br />';	
}
?>

<?php
mysql_connect('localhost', '', '');
mysql_select_db('');
$id = stripslashes($_GET['id']); // magic_quotes staat aan bij mij..
$sql = mysql_query("SELECT * FROM `2l2d_users` WHERE `usr_id` = '".$id."'");
while($arr = mysql_fetch_assoc($sql)) {
	echo $arr['usr_nick'].'<br />';	
}
?>

<?php
// filter input
if (isset($_GET['id']) && is_numeric($_GET['id'])) {
    $query = 'SELECT ...
              FROM ...
              WHERE id = '.mysql_real_escape_string($_GET['id']); // escape output
}
mysql_query($query) or die('sigh');
?>

<?php
// filter input
if (isset($_GET['id']) && is_numeric($_GET['id'])) {
    $query = 'SELECT ...
              FROM ...
              WHERE id = '.mysql_real_escape_string($_GET['id']); // escape output
}
mysql_query($query) or die('sigh');
?>

<?php
function isIndex($in) {
    return preg_match('#^[1-9][0-9]*$#', $in);
}

<?php
function isIndex($in) {
    return preg_match('#^[1-9][0-9]*$#', $in);
}

<?php
function escape($in) {
    return htmlspecialchars($in, ENT_QUOTES, 'UTF-8');
}
?>

<?php
function escape($in) {
    return htmlspecialchars($in, ENT_QUOTES, 'UTF-8');
}
?>