Re:Prevention of SQL injection in PHP
by duskwuff on Friday May 22, 2009 @07:41AM
(#621868)
As the blog comments are hinting, this is a terrible way to achieve "prevention of SQL injection". One missed addslashes() and you're toast. The real answer is to use prepared queries through mysqli, PDO, ADODB, or similar.
The developer who's writing this apparently hasn't ever tried SQL injection, though. If they had, they'd know that trying to tack on a second query with a semicolon doesn't work with PHP's mysql functions. The only real way to understand security flaws of this sort is to try exploiting them yourself.
The developer who's writing this apparently hasn't ever tried SQL injection, though. If they had, they'd know that trying to tack on a second query with a semicolon doesn't work with PHP's mysql functions. The only real way to understand security flaws of this sort is to try exploiting them yourself.