URL and mod_rewrite: use many special chars and keep data safe from attacks

I'm working on a site where contents pages are handled with mod_rewrite and I'm trying to make the URL managed with mod_rewrite protected from SQL injections with some char restriction, because users can create pages contents like this:

http://site.com/content-type/Page-created-by-user

My doubts come when they insert something like:

http://site.com/architect/Giovanni+Dall'Agata

I need to insert ' char because I can have names like this for example of famous architects, but I don't know if I can keep data safe and how prevent SQL injections with this character.

Should I do something particular to prevent attacks?

I'm using PDO class in PHP like this:

$architect = strip_tags (trim ($_REQUEST["architect"]));

// pdo class etc..
$pdo_stmt->bindParam (":arch", $architect, P开发者_Python百科DO::PARAM_STR);
// and the other code here...

Users can't create pages with these chars: < > / \ * ? = should I ban ' and " too? Or should I permit only one of ' and " chars or can I use them together and keep server safe?

---

$stmt->bindParam (and bindValue, and in general, prepared statements) are safe against SQL injection. All serious SB frameworks support a way of adding parameters to a query, and values added that way are sanitized. You should always do that and never insert variables data coming from users (see comments) manually into an SQL query string.

That still leaves the question of XSS injections, which are easier to miss (though also less dangerous); to avoid them, make sure you always use htmlspecialchars($var,ENT_QUOTES) (or urlencode, depending on the context).

---

PDO automatically escapes characters like ' so you should be ok, just make sure you have register_globals and magic_quotes turned off and always use bindParam for your queries.

Also if your talking about creating dynamic URL's you shouldn't have the ' character in them anyways. I always use:

$str = preg_replace("([^0-9a-zA-Z\-])", "", $str);

Which removes anything thats not 0-9, a-z or a dash from the string.