http://www.scuolaelettrica.it/buratto/php2/PHPSec.htm

You’re right, and I’ve posted it now, at:

http://phpit.net/code/valid-email/

I’ve also updated the article. Thanks for letting me know.

It would have been nice to see.

James: I kinda agree with you, although the valid_email() example I have is a good example of real validation.

Or better yes, use perl -T, and have the language *enforce* separation between validated and unvalidated data.

[code]
// Do validation

$s_Email = mysql_real_escape_string($d_Email);

[/code]

Thats more what i would say is escaping, validation is checking the length and the characters contained within the username/email address. Stripping out HTML tags etc…I suppose you could call it data cleansing.
Sorry to be a picky swine :)

if in php.ini -> magic_quote_gpc=on
$sql_query=”select * from table where email=’.addslashes(stripslashes($var[’email’])).’”;

One remark about prefixing variables to avoid mistakes. That is a good aproach. The method I personally apply is the one Chris Shiflett uses in his book. Start with declaring an empty $clean array. After that add only data to the $clean array after validation. Then, if you want to do something in your script, you only work with the $clean array. See for an example http://phpsecurity.org/code/ch01-3

This makes sure you never process tainted/unsafe data, even if a variable hasn’t been declared earlier on in your script. For example, if I process some data like this:
$clean = array();
$email = $_POST[’email’];
$sql = mysql_real_escape_string($clean[’Emali’]);
as you can see, there’s a typo in the last line. But apart from the fact that my script probably doesn’t work as intended, it is not dangerous. The variable “Emali” can not be injected from outside, because I declare the $clean array empty at the start of the script.

I find this approach very useful.

On the other hand, if I would have processed the line as:
$Email = $_POST[’email’];
$sql = mysql_real_escape_string($Emali);
the variable $Emali would not have been declared and could be injected from outside.

Hope I explained it well. There’s a lot to consider when you want to write secure scripts, so it’s good you give it some attention Dennis! And the links you provide are indeed excellent reading material for further study.