In PHP Manual, there is a note:
Note: If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks.
Is this enough to anti sql injection? If not, could you give an example and a good solution to anti sql injection?
-
1See [Does mysql_real_escape_string() FULLY protect against SQL injection? ](stackoverflow.com/questions/1220182/…).Matthew Flaschen– Matthew Flaschen2010-11-13 05:31:33 +00:00Commented Nov 13, 2010 at 5:31
-
definitely a duplicate of abovemjc– mjc2011-06-30 03:45:39 +00:00Commented Jun 30, 2011 at 3:45
Add a comment
|
3 Answers
mysql_real_escape_string is usually enough to avoid SQL injection. This does depend on it being bug free though, i.e. there's some small unknown chance it is vulnerable (but this hasn't manifested in the real world yet). A better alternative which completely rules out SQL injections on a conceptual level is prepared statements. Both methods entirely depend on your applying them correctly; i.e. neither will protect you if you simply mess it up anyway.
2 Comments
zerkms
just to clarify: there is also a chance that PDO emulates prepared queries (for mysql) and doesn't use native mysql ones. There is no such declaration in php documentation (or I cannot found one).
zerkms
"PDO will emulate for drivers that don't support them" --- is not enough, because: a) installed (old) libmysql can don't support prepared; b) PDO still can don't use native prepared statements.
As far as i know this is a solid way to avoid SQL Injection attacks.
The best solution is PDO.
If you're using the traditional mysql_query then running all of your data through mysql_real_escape_string() is enough.
1 Comment
bcosca
Parameterized queries are also available in the
PDO extensions