php:

function sql_quote($value){
        if(get_magic_quotes_gpc())
        $value = stripslashes($value);
 
        //check if this function exists
        if(function_exists("mysql_real_escape_string"))
                $value = mysql_real_escape_string( $value );
            else//for PHP version < 4.3.0 use addslashes
                $value = addslashes( $value );
 
        return $value;
    }

php:

$password = sql_quote($_POST['password']);
$query = mysql_query("SELECT * FROM usuarios WHERE usuario='admin' AND password='$password');

php:

/// Funcion sacada de sabrosus, modificada por Victor Bracco...
function enviaMail($to, $title, $body, $from) {
       $rp     = trim($from);
       $org    = " sabros.us";
       $mailer = "sabros.us Mailer";
 
       $head   = '';
       $head  .= "Content-Type: text/html \r\n";
       $head  .= "Date: ". date('r'). " \r\n";
       $head  .= "Return-Path: $rp \r\n";
       $head  .= "From: $from \r\n";
       $head  .= "Sender: $from \r\n";
       $head  .= "Reply-To: $from \r\n";
       $head  .= "Organization: $org \r\n";
       $head  .= "X-Sender: $from \r\n";
       $head  .= "X-Priority: 3 \r\n";
       $head  .= "X-Mailer: $mailer \r\n";
 
       $body   = str_replace("\r\n", "\n", $body);
       $body   = str_replace("\n", "\r\n", $body);
       if(is_array($to)
       {
            for_each($to as $suscriptor)
            {
                    @mail($to, $title, $body, $head);
            }
       } else {
                    @mail($to, $title, $body, $head);
       }

php:

function ValidarDatos($campo){
//Array con las posibles cadenas a utilizar por un hacker
$CadenasProhibidas = array("Content-Type:",
//evita email injection
"MIME-Version:", "Content-Transfer-Encoding:","Return-path:","Subject:","From:","Envelope-to:","To:","bcc:","cc:",
"UNION",
// evita sql injection
"DELETE","DROP","SELECT","INSERT","UPDATE","CRERATE","TRUNCATE","ALTER","INTO","DISTINCT","GROUP BY","WHERE","RENAME","DEFINE","UNDEFINE","PROMPT","ACCEPT","VIEW","COUNT","HAVING","'",'"',"{","}","[","]",
 // evita introducir direcciones web
"HOTMAIL","WWW",".COM","@","W W W",". c o m","http://",
//variables y comodines
"$", "&","*");
 
//Comprobamos que entre los datos no se encuentre alguna de 
//las cadenas del array. Si se encuentra alguna cadena se 
//dirige a la página anterior 
 
foreach($CadenasProhibidas as $valor){
    if(strpos(strtolower($campo), strtolower($valor)) !== false){
		echo("
        alert('No puede introducir direcciones web, comillas, corchetes, código de programación o cualquier dato no relativo a los campos del formulario');
		history.back();");
        exit;
        }
    }
}
//Asignamos la variable POST y llamada a la función Validardatos($texto)
$texto= $_POST["texto"];
ValidarDatos($texto);

php:

echo "\t\t<img class=\"preview\" src=\"http://www.webshotspro.com/thumb.php?url=&quot;.htmlspecialchars($row["enlace"])."\" alt=\"".htmlspecialchars($row["title"])."\" />";

php:

echo "\t\t<img class=\"preview\" src=\"http://sabros.us/thumbs/?url=&quot;.htmlspecialchars($row["enlace"])."&size=T\" alt=\"".htmlspecialchars($row["title"])."\" />";