OLD James Posted July 24, 2006 Share Posted July 24, 2006 I'm writing a small bulletin board system for a pre-existing code base. Im to use a pre-existing uthentication class. this class uses URLEncode() on the user name to avoid any malicious code being injected. Is URLEncode sufficient in this case? Is there a way that a malicious user could still perform an exploit in the user field to gain un-authenticated access?I know that an addition SQL query has spaces so that thats not a problem. but I'm sure i read somewhere that you can encode special characters to bypass url encoding. IE. to pass in a single quote or something similar.Any ideas and sugestions would be appreciated. I dont think i can modify the existing code without good cause.Thanks boys and girls. Quote Link to comment https://forums.phpfreaks.com/topic/15525-sql-injection-protection/ Share on other sites More sharing options...
kenrbnsn Posted July 24, 2006 Share Posted July 24, 2006 Use the function mysql_real_escape_string() (http://www.php.net/mysql_real_escape_string) on any text that is being inserted into the DB.Ken Quote Link to comment https://forums.phpfreaks.com/topic/15525-sql-injection-protection/#findComment-63039 Share on other sites More sharing options...
localhost Posted July 24, 2006 Share Posted July 24, 2006 Also think of using strip tags or addslashes, html entities, trim, etc. Quote Link to comment https://forums.phpfreaks.com/topic/15525-sql-injection-protection/#findComment-63048 Share on other sites More sharing options...
kenrbnsn Posted July 24, 2006 Share Posted July 24, 2006 You don't need addslashes() if you use mysql_real_escape_string(). The mysql_real_escape_string() will do everything addslashes does and more.Ken Quote Link to comment https://forums.phpfreaks.com/topic/15525-sql-injection-protection/#findComment-63051 Share on other sites More sharing options...
OLD James Posted July 24, 2006 Author Share Posted July 24, 2006 hanks fro the quick feed back.As I said I can't really change the pre-existing code for the authentication class. Thats not really my job nor do i have permission to. I do have to secure my portion of code to the best of my ability.I agree that mysql_real_escape_string() should be used, but just as a best practice. In order to get the developer to change the current implementation of the authentication class. I need to expalin why URLEncode isn't sufficient, but alas I'm not really sure why its not....? I tried passing in the few general SQL commands i know of and it seems to stop them. so what else is there? Quote Link to comment https://forums.phpfreaks.com/topic/15525-sql-injection-protection/#findComment-63080 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.