• Advertisement
Sign in to follow this  

Question with PHP accessing mysql

This topic is 1911 days old which is more than the 365 day threshold we allow for new replies. Please post a new topic.

If you intended to correct an error in the post then please contact us.

Recommended Posts

I have a custom web application I am playing around with written in php accessing a mysql database using a html interface.
Let me qualify this and say that I am very new to PHP and I may be unaware of something considered standard.

I am calling functions from inside my php (webpage) file that the user accesses with 2 or more variables like:

function TestFunctionRpt($orderby,$sort)

I sanitize both of my input variables using the PHP function "mysql_real_escape_string()".
http://php.net/manual/en/function.mysql-real-escape-string.php

Now my question is this, this seems very very simple am I actually protecting myself from SQL injection?
Is there anything else I need to look out for?

Also for reference my function is called like this inside my page.

[source lang="php"]<?php echo $mysite->TestFunctionRpt($_GET ['orderby'],$_GET ['sort'],$_GET['cust'],$_GET['startdate'],$_GET['enddate']);?>
[/source]

Thank you for reading, hopefully you are having a great day! Edited by yewbie

Share this post


Link to post
Share on other sites
Advertisement
Use parameterized queries. Don't just concatenate strings together to make your SQL statements.

Share this post


Link to post
Share on other sites
[quote name='Washu' timestamp='1351206013' post='4993956']
Use parameterized queries. Don't just concatenate strings together to make your SQL statements.
[/quote]

Here is what I am currently doing, does this count as a parameterized query?

[source lang="php"]BlahRpt($orderby,$startdate,$enddate)
{
$sanorderby = $this->SanitizeForSQL($orderby);
$sanstartdate = $this->SanitizeForSQL($startdate);
$sanenddate = $this->SanitizeForSQL($enddate);

$qry = "Select * from $this->tablename WHERE `RequiredDate` >= '$sanstartdate' AND `RequiredDate` <= '$sanenddate' ORDER BY $sanorderby ASC";
}
[/source]


[source lang="php"]function SanitizeForSQL($str)
{
if( function_exists( "mysql_real_escape_string" ) )
{
$ret_str = mysql_real_escape_string( $str );
}
else
{
$ret_str = addslashes( $str );
}
return $ret_str;
}[/source] Edited by yewbie

Share this post


Link to post
Share on other sites
No, that's string concatenation at its best/worst.

http://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php Edited by Washu

Share this post


Link to post
Share on other sites
Thank you very very much, that link was very informative.

So Bind, Prepare, Execute. Seems easy enough.
And feel free to not answer this if its a long response (as I am trying to google the answer after I post this).

My guess would be even though I am removing escape sequences there are ways around that through injection?

Also I have found a great deal of information on the php page about why using mysql_real_escape_string is bad. http://php.net/manual/en/function.mysql-real-escape-string.php

Thank you for your time Washu =)

Share this post


Link to post
Share on other sites
[quote name='yewbie' timestamp='1351214136' post='4993992']
My guess would be even though I am removing escape sequences there are ways around that through injection?
[/quote]

No, there shouldn't be unless there is a bug in PHPs mysql library or you are using multiple sql connections with different char-sets (in which case you have to pass the connection to the escape function aswell), but it is still a good idea to always use parameterized queries because they are virtually impossible to mess up with. (PHP will not complain if you forget/miss escaping a value, you will get an error if you don't use parameterized queries correctly)

Share this post


Link to post
Share on other sites
Sign in to follow this  

  • Advertisement