title: Does eliminating dangerous characters avoid SQL-injection?
body: <p>Avoiding SQL-injections there are many ways <a href="https://stackoverflow.com/questions/60174/how-to-prevent-sql-injection-in-php?rq=1">How to prevent SQL injection in PHP?</a>.</p>
  
  <p>The question is, how is it possible to sql-inject through <code>removeBadCharacters</code>?</p>
  
  <pre><code>function removeBadCharacters($s)
  {
     return str_replace(array('&amp;','&lt;','&gt;','/','\\','"',"'",'?','+'), '', $s);
  }
  </code></pre>
  
  <p>It tries to throw out dangerous characters <em>(the application doesn't need those characters)</em>:</p>
  
  <pre><code>$x = removeBadCharacters($_POST['data']);
  
  mysql_query("insert into table (x) values ('".$x."');");
  
  // or
  
  mysql_query("select * from into where name = '".$x."';"); 
  </code></pre>