I just had this idea of "preSecure" all userinput data from $_post and $_get. But I was wondering if this is good practice and would like some input on this. Here is what I came up with:  function clean_str($str){     return preg_replace('#[^a-z_ 0-9@.-]#i', '', $str); }  if ($_POST){     foreach ($_POST AS $key =&gt; $val){         $_POST[$key] = clean_str($val);     } }  if ($_GET){     foreach ($_GET AS $key =&gt; $val){         $_GET[$key] = clean_str($val);     } }   This snippet would simply be run at the beginning of each http request. The clean_str function can be developed to allow other chars and replace characters etc (this is just an example). But I think the first goal are to simply prevent sql injection. The only bad thing I can see with this approach right now is if your "plugin" need to send sql commands from user input. The appraoch above could we wrapped in a function of course and be called if needed. Post and Get are global vars so that would not be a problem.  I'm actually writing my own framework (still a lot of work) that I will release if I ever be able to finish it. The thing is that I often see novice developers add $_POST['userinput'] inside database queries. The code above should make even that okay. Well that was some background of what I'm up to and why I bring this up.  I would be very happy to hear your thoughts. This might not be the best question for Stack Overflow, I suppose I want to open more like a discussion to this approach to share thoughts and inputs. But to formulate my question(s) to this, it would be something in line with: Are there any other approaches that would be faster or more scalable than this, or is equal to this, or can another function complement this approach? Is this approach good practice? Is it okay to overwrite the global vars of post and get data like above?  I know the code above is not object oriented, but it's about the approach of cleaning the users' input datas automatically before running checks on them. I think this will save a lot of code and headaches.  Please share your thoughts with me. As comments are limited here on Stack Overflow, I would appreciate if you reply as answers if you bring new thoughts to this table. Comments are to comment on specific thoughts/answers in this case.
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
How would you cut a shape out of an object using another object? BeanFactory vs ApplicationContext I'm pretty new to the Spring Framework, I've been playing around with it and putting a few samples apps together for the purposes of evaluating Spring MVC for use in an upcoming company project. So far I really like what I see in Spring MVC, seems very easy to use and encourages you to write classes that are very unit test-friendly.  Just as an exercise, I'm writing a main method for one of my sample/test projects. One thing I'm unclear about is the exact differences between BeanFactory and ApplicationContext - which is appropriate to use in which conditions?  I understand that ApplicationContext extends BeanFactory, but if I'm just writing a simple main method, do I need the extra functionality that ApplicationContext provides? And just exactly what kind of extra functionality does ApplicationContext provide?  In addition to answering "which should I use in a main() method", are there any standards or guidelines as far as which implementation I should use in such a scenario? Should my main() method be written to depend on the bean/application configuration to be in XML format - is that a safe assumption, or am I locking the user into something specific?  And does this answer change in a web environment - if any of my classes needed to be aware of Spring, are they more likely to need ApplicationContext?  Thanks for any help. I know a lot of these questions are probably answered in the reference manual, but I'm having a hard time finding a clear breakdown of these two interfaces and the pros/cons of each without reading thru the manual with a fine-tooth comb. I have this annoying problem in Gmail. Spammers are by-passing the Gmail spam filters and are so clever that I am not able to create a manual filter of my own to block them. They are sending me junk mails from e-mail IDs of the form:  Jewelskart@greatestjewels.in via watchstore.cleanmail.in  Shoppingkart@shoppers.in via watchstore.cleanmail.in   In general,  something@somethingelse.in via watchstore.cleanmail.in   Now, I cant set a filter for each and every mail as they are from different IDs. The common part is the via address which is watchstore.cleanmail.in. But when I try creating a filter with watchstore.cleanmail.in in From field, Gmail doesn't list these emails. In short, the filter is not able to detect via addresses.  Report Spam/Unsubscribe options aren't working.  How can I get rid of these annoying spammers? For simple linear regression, the regression coefficient is calculable directly from the variance-covariance matrix $C$, by  $$ C_{d, e}\over C_{e,e} $$ where $d$ is the dependent variable's index, and $e$ is the explanatory variable's index.  If one only has the covariance matrix, is it possible to calculate the coefficients for a model with multiple explanatory variables?   ETA: For two explanatory variables, it appears that $$\beta_1 = \frac{Cov(y,x_1)var(x_2) - Cov(y,x_2)Cov(x_1,x_2)}{var(x_1)var(x_2) - Cov(x_1,x_2)^2} $$ and analogously for $\beta_2$. I'm not immediately seeing how to extend this to three or more variables. Every time I try to create a table using MySQL Workbench 6.3 CE it adds "broken" comments at the end of the script.  Example:  I am trying to create a table called "user". This is what the table should look like:   However when I click the apply button, the script generates incorrectly:  CREATE TABLE `user` (   `userid` INT NOT NULL AUTO_INCREMENT COMMENT '',   `record_status` INT NOT NULL DEFAULT 1 COMMENT '',   `createdby` VARCHAR(75) NOT NULL COMMENT '',   `createddate` DATETIME NOT NULL COMMENT '',   `updatedby` VARCHAR(75) NULL COMMENT '',   `updateddate` DATETIME NULL COMMENT '',   `username` INT NOT NULL COMMENT '',   `password` VARCHAR(75) NULL COMMENT '',   `firstname` VARCHAR(75) NULL COMMENT '',   `lastname` VARCHAR(75) NULL COMMENT '',   `email` VARCHAR(75) NULL COMMENT '',   `facebook_userid` VARCHAR(75) NULL COMMENT '',   `email_verified` VARCHAR(75) NULL COMMENT '',   PRIMARY KEY (`userid`, `username`)  COMMENT '');   The comment in this line should not be there, so the code should be:   PRIMARY KEY (`userid`, `username`));   and the code executes when I paste it into an editor and remove this comment. However I create massive databases daily. (Each with +- 15 tables). I can't keep doing this for each table as it is time consuming.  How can I disable this feature that adds the comments to the script? I don't need them in my databases Low Quality Posts reviews add comments more than once on behalf of reviewer If Eren Jaeger dies without transfering his titan powers, will both powers transfer to the same child? It's told in the story that if a titan shifter dies without transferring his power, this power will go to an eldian person who just was born. If Eren Jaeger dies without transferring his titan powers, will the attack titan and the founding titan go to different persons?  Note that his is not a duplicate of  as this is not about what happens when a titan shifter dies. But what happens if a titan shifter with 2 powers dies, which is not answered in the answer. How do I save files edited with vim? What's a word/phrase for a player/seducer? I can't seem to remember this particular word/phrase. I'm almost certain it's a two-word phrase. It specifically refers to someone who is skilled with the ladies, ie, someone who knows the tricks of the trade.  Usage: - "Unless you're a X-Y, that's not going to work with her."  Edit :  I'm not looking for 'ladies man', 'casanova', 'womanizer' etc. This phrase refers to someone who's more of a pro and one who is serious about his business. Let's say that there is a question asked in a bad manner, in a way that the question is missing. For example the user shows the code and doesn't explain very well which is the problem.    Usually someone starts digging in the OP mind posting comments and asking him for details. It may happen that the question gets edited and the OP edits it to a valid question.    Do you usually give the OP time to edit the question or you immediately vote to close it? How should a family with young children apply for UK visas? We are sponsoring a family to visit us in UK as friends from Madagascar for two weeks. They have a 6 year old and a 16 month old.   Do the kids need their own visas, and are they the standard visitor visa or a special child visa?   Also, when I try and apply on the website I can only apply for one person so how do I apply for all the individuals in the family?   I have looked on the Immigration website and can't find the answers I need. What is a simple example of an unprovable statement? How can I find posts related to lost reputation due to a "user was removed" message? Today I noticed that my reputation got truncated by 64 points, and when I looked at my reputation history, I saw  notifying me of points removal along to a "user was removed" message. Each has a slightly different timestamp, ranging from 12:39:04 to 12:39:43.    I can't find the questions/answers concerned by this (and I don't remember having won as much as 65 points once, making this even stranger). I would like to find out how I could have lost 65 points while I never won as much in a single question/answer.  Is there a way I can check which of my posts were impacted? I have a command that I want to have run again automatically each time it terminates, so I ran something like this:  while [ 1 ]; do COMMAND; done;   but if I can't stop the loop with Ctrl-c as that just kills COMMAND and not the entire loop.  How would I achieve something similar but which I can stop without having to close the terminal? "Inspirational" quote at start of chapter Is the harmonic oscillator potential unique in having equally spaced discrete energy levels? I want to use Google Chrome and Google search instead of Bing when I search in Windows 10.   Google Chrome is launched when I click on web, but it's Bing search. (My default search engine on Google and Edge is )    I haven't found how to configure that.  Someone can help me ? A get() like method for checking for Python attributes If I had a dictionary dict and I wanted to check for dict['key'] I could either do so in a try block (bleh!) or use the get() method, with False as a default value.  I'd like to do the same thing for object.attribute. That is, I already have object to return False if it hasn't been set, but then that gives me errors like     AttributeError: 'bool' object has no attribute 'attribute' What are some good tutorials on writing custom styles (classes) that clearly explain commands used and some of the features that TeX has to offer in the way of styles? Cause of black artifacts in render? I was following  on creating a watch and noticed that when I rendered the watch, some pieces were messed up.  I'm new to 3D modeling and I've just learned Blender, I can't explain it well, so here's a picture:    Other examples:     I don't know if it's a problem with my World texture, the object, or the object's texture/material, so I can't even guess how to fix it. What causes this? Is it possible to fix it?