How to protect this SQL in a PHP from SQL Injection?

Question

Can someone give me a little help with this? i have three PHP SQL querys, and i have to protect from SQL Injection. I am searching on google but i think is too hard for me, because it's combinated with PHP and i dont know munch about PHP and lees about SQL

if someone can give me the code protected I'll be grateful

the code:

$q=mysql_query("SELECT * FROM user where email= '".$_REQUEST['email']."'",$link );

$q=mysql_query("UPDATE user SET mobilePhone='".$_REQUEST['mobilePhone']."', fullName='".$_REQUEST['fullName']."' WHERE email='".$_REQUEST['email']."'",$link );

$q=mysql_query("UPDATE user SET mobilePhone='".$_REQUEST['mobilePhone']."' , fullName='".$_REQUEST['fullName']."', password='".$_REQUEST['password']."'  WHERE email='".$_REQUEST['email']."'",$link );

possible duplicate of Best way to stop SQL Injection in PHP

Daniel DiPaolo
– Daniel DiPaolo

2010-12-17 18:42:53 +00:00
Commented Dec 17, 2010 at 18:42 — Daniel DiPaolo
– Daniel DiPaolo, Commented Dec 17, 2010 at 18:42

Community · Accepted Answer · 2023-11-17 20:38:18Z

2

Well, the simple way would be to wrap each of the $_REQUEST vars in mysql_real_escape_string()...

$q=mysql_query("SELECT * FROM user 
    where email= '".mysql_real_escape_string($_REQUEST['email'])."'",$link );

The better way would be to use prepared queries. There are plenty of tutorials available on how to do it, so I'll leave that to you...

edited Nov 17, 2023 at 20:38

CommunityBot

11 silver badge

answered Dec 17, 2010 at 18:42

ircmaxell

166k36 gold badges269 silver badges316 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Sarfraz · Accepted Answer · 2010-12-17 18:42:27Z

2

The least you can do to prevent SQL injection is to use mysql_real_escape_string function before any variables that go into your queries.

The best you can do is to use prepared statements to avoid SQL injection.

The parameters to prepared statements don't need to be quoted; the driver automatically handles this. If an application exclusively uses prepared statements, the developer can be sure that no SQL injection will occur (however, if other portions of the query are being built up with unescaped input, SQL injection is still possible).

Suggestion:

To be further on safer side, you should always use proper array eg $_POST or $_GET instead of $_REQUEST for security reasons.

answered Dec 17, 2010 at 18:42

Sarfraz

384k81 gold badges561 silver badges613 bronze badges

Comments

Eamorr · Accepted Answer · 2010-12-17 18:42:05Z

1

Take a look at PHP's mysql_real_escape_string

answered Dec 17, 2010 at 18:42

Eamorr

10.1k35 gold badges131 silver badges210 bronze badges

3 Comments

Nathan Over a year ago

prepared statements with placeholders are a much better practice.

ircmaxell Over a year ago

+1 as while prepared statements are better, that doesn't mean using mres is a bad thing. You're still safe...

Your Common Sense Over a year ago

@ircmaxell nothing bad in mres, if used wisely. And a fool (loke OP) would fail with prepared. A brain is the only necessary thing, and the rest is optional.

Collectives™ on Stack Overflow

How to protect this SQL in a PHP from SQL Injection?

3 Answers 3

Comments

Comments

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related