Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #7591 > unrolled thread

Data sanitation for mysql queries.

Back to article view | Back to comp.lang.php

Contents

  Data sanitation for mysql queries. cph <cloudpresshosting@gmail.com> - 2012-11-16 10:10 -0800
    Re: Data sanitation for mysql queries. Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2012-11-16 10:49 -0800
    Re: Data sanitation for mysql queries. Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-16 13:56 -0500
      Re: Data sanitation for mysql queries. cph <cloudpresshosting@gmail.com> - 2012-11-16 11:36 -0800
        Re: Data sanitation for mysql queries. Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-16 16:46 -0500
        Re: Data sanitation for mysql queries. "Peter H. Coffin" <hellsop@ninehells.com> - 2012-11-17 19:47 -0600

#7591 — Data sanitation for mysql queries.

FOr sanitizing user input that will be part of a mysql query is addslashes() good enough to prevent mysql injection?

[toc] | [next] | [standalone]

#7592

On 11/16/12 10:10 AM, cph wrote:
> FOr sanitizing user input that will be part of a mysql query is addslashes() good enough to prevent mysql injection?
>

Short answer is no.

Prepared statements help a lot.

Using the correct functions help too:
<http://www.php.net/manual/en/mysqli.real-escape-string.php>

[toc] | [prev] | [next] | [standalone]

#7593

On 11/16/2012 1:10 PM, cph wrote:
> FOr sanitizing user input that will be part of a mysql query is addslashes() good enough to prevent mysql injection?
>

Not at all.  You need to validate the data, i.e. integer values are 
actually integers, dates are valid, etc.  You can use bind parameters as 
Daniel indicated, or you can use mysql_real_escape_string() on strings. 
Numeric values, dates, etc. do not need further processing if they have 
been properly validated.  But they need to be validated even if you're 
using bind parameters.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#7594

I am not asking about validation that is a whole other topic. This is specifically about sanitation. The problem with real_escape_string is from what I have read its not good enough to prevent sql injections.

On Friday, November 16, 2012 10:56:08 AM UTC-8, Jerry Stuckle wrote:
> On 11/16/2012 1:10 PM, cph wrote:
> 
> > FOr sanitizing user input that will be part of a mysql query is addslashes() good enough to prevent mysql injection?
> 
> >
> 
> 
> 
> Not at all.  You need to validate the data, i.e. integer values are 
> 
> actually integers, dates are valid, etc.  You can use bind parameters as 
> 
> Daniel indicated, or you can use mysql_real_escape_string() on strings. 
> 
> Numeric values, dates, etc. do not need further processing if they have 
> 
> been properly validated.  But they need to be validated even if you're 
> 
> using bind parameters.
> 
> 
> 
> -- 
> 
> ==================
> 
> Remove the "x" from my email address
> 
> Jerry Stuckle
> 
> JDS Computer Training Corp.
> 
> jstucklex@attglobal.net
> 
> ==================

[toc] | [prev] | [next] | [standalone]

#7595

On 11/16/2012 2:36 PM, cph wrote:
> On Friday, November 16, 2012 10:56:08 AM UTC-8, Jerry Stuckle wrote:
>> On 11/16/2012 1:10 PM, cph wrote:
>>
>>> FOr sanitizing user input that will be part of a mysql query is addslashes() good enough to prevent mysql injection?
>>
>>>
>>
>>
>>
>> Not at all.  You need to validate the data, i.e. integer values are
>>
>> actually integers, dates are valid, etc.  You can use bind parameters as
>>
>> Daniel indicated, or you can use mysql_real_escape_string() on strings.
>>
>> Numeric values, dates, etc. do not need further processing if they have
>>
>> been properly validated.  But they need to be validated even if you're
>>
>> using bind parameters.
>>
>>
>>

 > I am not asking about validation that is a whole other topic. This is
 > specifically about sanitation. The problem with real_escape_string is
 > from what I have read its not good enough to prevent sql injections.

<Top posting fixed>

The whole purpose of mysql_escape_string() is to prepare strings for 
insertion into the database.  Where did you read it wasn't good enough 
to prevent sql injections?

P.S. Please don't top post.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#7618

On Fri, 16 Nov 2012 11:36:18 -0800 (PST), cph wrote:

> I am not asking about validation that is a whole other topic. This is
> specifically about sanitation. The problem with real_escape_string is
> from what I have read its not good enough to prevent sql injections.

Where did you read that? It's better than add_slashes because it's
actually AWARE of the connection parameters, like what the actual escape
character is. 

-- 
54. I will not strike a bargain with a demonic being then attempt to 
    double-cross it simply because I feel like being contrary.
	--Peter Anspach's list of things to do as an Evil Overlord

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web