Jump to content

Archived

This topic is now archived and is closed to further replies.

OLD James

SQL injection protection

Recommended Posts

I'm writing a small bulletin board system for a pre-existing code base. Im to use a pre-existing uthentication class. this class uses URLEncode() on the user name to avoid any malicious code being injected. Is URLEncode sufficient in this case? Is there a way that a malicious user could still perform an exploit in the user field to gain un-authenticated access?
I know that an addition SQL query has spaces so that thats not a problem. but I'm sure i read somewhere that you can encode special characters to bypass url encoding. IE. to pass in a single quote or something similar.

Any ideas and sugestions would be appreciated. I dont think i can modify the existing code without good cause.

Thanks boys and girls.

Share this post


Link to post
Share on other sites
Use the function mysql_real_escape_string() (http://www.php.net/mysql_real_escape_string) on any text that is being inserted into the DB.

Ken

Share this post


Link to post
Share on other sites
You don't need addslashes() if you use mysql_real_escape_string(). The mysql_real_escape_string() will do everything addslashes does and more.

Ken

Share this post


Link to post
Share on other sites
hanks fro the quick feed back.
As I said I can't really change the pre-existing code for the authentication class. Thats not really my job nor do i have permission to. I do have to secure my portion of code to the best of my ability.
I agree that mysql_real_escape_string() should be used, but just as a best practice. In order to get the developer to change the current implementation of the authentication class. I need to expalin why URLEncode isn't sufficient, but alas I'm not really sure why its not....? I tried passing in the few general SQL commands i know of and it seems to stop them. so what else is there?

Share this post


Link to post
Share on other sites

×

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.