Is this a good way to defend against SQL injections?

[a_bertrand]

why not simply use the function "mysql_real_escape_string" which would ALWAYS work? Instead of something which may not work....

[Diesl]

To add on,

You are only filtering for given character values in your string. While you maybe eliminating character values that are used in an SQL injection, what a_bertrand said is much more efficient and clean. Also, since I see that you are using this in some sort of message query, you are going to strip possible characters that the user would use normally in the chat, such as a question mark, period, etc. That is not ideal at all.

[rulerofzu]

$atsakymas=mysql_real_escape_string($_POST['atsakymas']);

will suffice

[Djkanna]

Parameter Binding, is also an option.

[sniko]

trim()

nl2br()

stripslashes()

[galdikas]

Labas... Ok i know ths is is offtopic.. but how do you send message for someone on this site?? Cant find link anywhere (I just want to PM the starter, so thought it would be appropiate to post it here lol)

And on topic: I wouldn't use Lithuanian in your code.. ;) English is more universal.. and what if your game ever becomes big an popular, and you will want to hire a non-Lithuanian dev??

Edited April 19, 2011 by galdikas

[Djkanna]

The member needs to have PM's turned on in their settings before you can message them.

[galdikas]

Its the guys that do it for hobbie that ussually create anything worth a damn ;)

Add me on skype= Eketgolt :)