PHP regex for checking if it contains any sql

Question

How can I use PHP preg_match for a string to check if it contains any sql? Not for preventing SQL injection but just to tell if it contains a sql statement

You can't. You can look for some SQL specific keywords, but to check if its valid SQL you need some heavier logic. — SBH
– SBH, Commented Nov 17, 2014 at 17:58
You could try to execute the query and get the return of that execute in a variable. You could set up a test database for these queries so your actual data isn't compromised. — Triplus
– Triplus, Commented Nov 17, 2014 at 18:07
$sql = 's' . 'e' . 'l' . 'e' . 'c' . 't' . 'etc...'. There's a string that contains some SQL...good luck coming up with a regex that could detect every potential variation of that... — Marc B
– Marc B, Commented Nov 17, 2014 at 18:09

Community · Accepted Answer · 2017-05-23 12:08:53Z

3

Checking a string for SQL is not worth your time or resources for that matter. If the goal is to prevent injection you should use PDO.

$stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name');

$stmt->execute(array('name' => $name));

foreach ($stmt as $row) {
    // do something with $row
}

Reference material: How can I prevent SQL injection in PHP?

edited May 23, 2017 at 12:08

CommunityBot

11 silver badge

answered Nov 17, 2014 at 18:00

Edwin

1,1252 gold badges17 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP regex for checking if it contains any sql

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related