Re: is this script secured enough from internet attacks

[moritz]

The antiInjection sub is bullshit. The real way to prevent SQL injections is to use prepared statements and placeholders, instead of disallowing use of some SQL keywords in data.

The checks for "forbidden characters" in the params depends on what you want to do with them eventually, so there's no way for us to assess if it's secure for your use case.

[tercoz]

Thank you, I shall remove that sub. As I am new here I don't know how to give points, I want to thank you and other people for helping me(points), which way can i do so7

[Sewi]

Prepared statements and placeholders don't always work as expected (for example FreeTDS has problems there).

unpack could cover all injection attempts:

'INSERT INTO foo(bar) VALUES(0x'.unpack('H*',$value).')'

[Discipulus]

how does this unpack H* insert into work?