Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.php > #7595
| From | Jerry Stuckle <jstucklex@attglobal.net> |
|---|---|
| Newsgroups | comp.lang.php |
| Subject | Re: Data sanitation for mysql queries. |
| Date | 2012-11-16 16:46 -0500 |
| Organization | A noiseless patient Spider |
| Message-ID | <k86c82$j7v$1@dont-email.me> (permalink) |
| References | <56c7dfc2-c368-4403-8d7d-19233367f2c2@googlegroups.com> <k86287$i8i$1@dont-email.me> <b5d58a67-e183-4792-9e17-f16ce6f451b2@googlegroups.com> |
On 11/16/2012 2:36 PM, cph wrote: > On Friday, November 16, 2012 10:56:08 AM UTC-8, Jerry Stuckle wrote: >> On 11/16/2012 1:10 PM, cph wrote: >> >>> FOr sanitizing user input that will be part of a mysql query is addslashes() good enough to prevent mysql injection? >> >>> >> >> >> >> Not at all. You need to validate the data, i.e. integer values are >> >> actually integers, dates are valid, etc. You can use bind parameters as >> >> Daniel indicated, or you can use mysql_real_escape_string() on strings. >> >> Numeric values, dates, etc. do not need further processing if they have >> >> been properly validated. But they need to be validated even if you're >> >> using bind parameters. >> >> >> > I am not asking about validation that is a whole other topic. This is > specifically about sanitation. The problem with real_escape_string is > from what I have read its not good enough to prevent sql injections. <Top posting fixed> The whole purpose of mysql_escape_string() is to prepare strings for insertion into the database. Where did you read it wasn't good enough to prevent sql injections? P.S. Please don't top post. -- ================== Remove the "x" from my email address Jerry Stuckle JDS Computer Training Corp. jstucklex@attglobal.net ==================
Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Data sanitation for mysql queries. cph <cloudpresshosting@gmail.com> - 2012-11-16 10:10 -0800
Re: Data sanitation for mysql queries. Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2012-11-16 10:49 -0800
Re: Data sanitation for mysql queries. Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-16 13:56 -0500
Re: Data sanitation for mysql queries. cph <cloudpresshosting@gmail.com> - 2012-11-16 11:36 -0800
Re: Data sanitation for mysql queries. Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-16 16:46 -0500
Re: Data sanitation for mysql queries. "Peter H. Coffin" <hellsop@ninehells.com> - 2012-11-17 19:47 -0600
csiph-web