PHP sql treat special characters - php

Question

$sql = "INSERT INTO golf (datum, odkud, odjezd ) VALUES ('$datum', '$odkud', '$odjezd')";
if(!mysqli_query($connection,$sql)) {
echo '<p class="error">Záznam nebyl vložen</p>';
} else {
header ("location :/golf");
}
Hello, I am working on my thesis to school. I have this code and my supervisor keeps telling me to "treat special characters". How do I do that? He only saw the code I showed you.

Answer 1

your supervisor just ask you to treat special characters 😊. For that #Pedro’s answer is enough.
$odjezd = mysqli_real_escape_string($connection, $odjezd) // copied from #Pedro’s answer
But if you need more validation,
you can check the format of the date is correct?
$test_arr = explode('/', $POST[‘date’]);
if (count($test_arr) == 3) {
if (checkdate($test_arr[0], $test_arr[1], $test_arr[2])) {
// valid date ...
} else {
// problem with dates ...
}
} else {
// problem with input ...
}
Likewise you can validate your data according to your required way.
this might be helpful.

Answer 2

User input MUST be sanitized prior to insertion, you'll be opening a door into your server otherwise.
You also need to validate the input. What I normally do, is create a series of regex to validate each field individually, or use one of the available php validate filters.
Remember, you can - and should - do client side validation, which is great to reduce server load, but has 0 value as a security measure because it can be easily faked.
server side validation is the most important as it's your last line of defense.
Don't take user input lightly, tons of servers get hacked due to bad or nonexistent user input sanitization.
To directly answer your question, mysqli_real_escape_string() is your friend to escape special characters, i.e.:
$odjezd = mysqli_real_escape_string($connection, $odjezd)
Characters encoded are NUL (ASCII 0), \n, \r, \, ', ", and Control-Z.
Update:
I have used mysqli_real_escape_string and i am still able to submit
"a{b}c'=%" I would like it to remove spec.characters and just input
abc...how?
Let's assume that $odkud can only contain letters or digits and be 5 chars long only to validate, we can use preg_match() as validator, i.e.:
$id = $_REQUEST['id'];
if (preg_match('/^[a-z\d]{5}$/i', $odkud)) {
# Successful match
} else {
# Match attempt failed
}
Live Regex Example & Explanation
If you just need to remove the special characters use one of the php filters mentioned above or preg_replace, i.e.:
$odkud_filtered = preg_replace('/[^a-z\d]/i', '', $odkud);
# abc
Live Regex Example & Explanation