PHP protecting itself from SQL injections?

Question

When I send ");-- from an input field to my localhost PHP server, it AUTOMATICALLY converts it to

\");--

It seems great, except that I don't know how trustworthy this behavior is. Although it seems to avoid SQL injections, my development environment is not the same as the production environment and I'm afraid that the production environment may not have this sort of protection automatically activated...

Why does PHP does this(convert the input without having to use mysql_real_escape_string)? Does it always do it or only with certain extensions? Is it safe to rely on this behavior to prevent SQL injections?

Gumbo · Accepted Answer · 2009-03-15 18:44:33Z

6

It seems that you have Magic Quotes enabled. But you better disable this option or revert them. mysql_real_escape_string is more secure.

answered Mar 15, 2009 at 18:44

Gumbo

657k112 gold badges792 silver badges852 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

luiscubal Over a year ago

Yes, I had heard about them, but I never knew exactly what they were. I felt unsafe since I didn't know exactly what was going on. That's why I asked this. I'm going to turn it off so I can get control over my server again.

Gumbo Over a year ago

I recommend you to read one of the questions here on SO that explain why Magic Quotes are bad practice and show the difference between Magic Quotes and mysql_real_escape_string().

troelskn Over a year ago

Actually, if you have the option, use prepared statements instead of escaping data.

luiscubal Over a year ago

I'm not sure my server supports them, but I'll remember that name. The concept seems interesting, but doesn't seem to magically remove the injection threat - mysql_real_escape_string still seems to be needed.

troelskn Over a year ago

PDO has prepared statements. That has been standard from version 5.1. You don't use explicit escaping (mysql_real_escape_string) when you use prepared statements.

MattJ · Accepted Answer · 2009-03-15 18:52:16Z

1

This "feature" of PHP is known as "magic quotes". As 'magic' as they may be, it is extremely bad practice to use them, as they do little more than give a false sense of security. Thankfully they have been removed from PHP 6 (in development).

A more detailed list of criticisms can be found in this Wikipedia article.

The PHP manual describes various ways to disable magic quotes.

answered Mar 15, 2009 at 18:52

MattJ

7,9441 gold badge31 silver badges33 bronze badges

Comments

karim79 · Accepted Answer · 2009-03-15 19:43:58Z

1

You might want to get into talking to the database using an abstraction layer like Zend_Db. For example, if you create a select statement by instantiating a Zend_Db_Select, it would look like this:

//$_GET['thing'] is automatically escaped 
$select = $zdb->select()->from('things')->where('name = ?',$_GET['thing']);
$result = $zdb->fetchRow($select->__toString());//__toString generates a really pretty, vendor independent query

//a plain vanilla query would look like this:
$result = $zdb->fetchRow('select * from things where name = ?', $zdb->quote($_GET['thing']);

answered Mar 15, 2009 at 19:43

karim79

343k67 gold badges420 silver badges409 bronze badges

Collectives™ on Stack Overflow

PHP protecting itself from SQL injections?

3 Answers 3

5 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

5 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related