Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #7594

Re: Data sanitation for mysql queries.

Show all headers | View raw

I am not asking about validation that is a whole other topic. This is specifically about sanitation. The problem with real_escape_string is from what I have read its not good enough to prevent sql injections.

On Friday, November 16, 2012 10:56:08 AM UTC-8, Jerry Stuckle wrote:
> On 11/16/2012 1:10 PM, cph wrote:
> 
> > FOr sanitizing user input that will be part of a mysql query is addslashes() good enough to prevent mysql injection?
> 
> >
> 
> 
> 
> Not at all.  You need to validate the data, i.e. integer values are 
> 
> actually integers, dates are valid, etc.  You can use bind parameters as 
> 
> Daniel indicated, or you can use mysql_real_escape_string() on strings. 
> 
> Numeric values, dates, etc. do not need further processing if they have 
> 
> been properly validated.  But they need to be validated even if you're 
> 
> using bind parameters.
> 
> 
> 
> -- 
> 
> ==================
> 
> Remove the "x" from my email address
> 
> Jerry Stuckle
> 
> JDS Computer Training Corp.
> 
> jstucklex@attglobal.net
> 
> ==================

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Data sanitation for mysql queries. cph <cloudpresshosting@gmail.com> - 2012-11-16 10:10 -0800
  Re: Data sanitation for mysql queries. Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2012-11-16 10:49 -0800
  Re: Data sanitation for mysql queries. Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-16 13:56 -0500
    Re: Data sanitation for mysql queries. cph <cloudpresshosting@gmail.com> - 2012-11-16 11:36 -0800
      Re: Data sanitation for mysql queries. Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-16 16:46 -0500
      Re: Data sanitation for mysql queries. "Peter H. Coffin" <hellsop@ninehells.com> - 2012-11-17 19:47 -0600

csiph-web