SQL Injection prevention and wildcards

[siric]

Hi,

 

I am doing a search on a table with a string that will be submitted by a user and want to prevent sql injection and am using mysql_real_escape_string.

 

The thing is that my search is a wildcard search

 

$search = mysql_real_escape_string($contains);
$search = "%".$search."%";

 

If attempts an injection, the $search string equates to '%%', when then returns results for the entire table.

 

Even if I add

if ($calysponiansearch == '%%') {
      $calypsoniansearch = "%a";
}

 

that does not work as the escaped characters are there but not displayed.

 

 

How can I prevent this?

 

Thanks

 

Steve

 

 

[Mchl]

That has nothing to do with injection. Unless passing an empty string can be considered an injection...

 

$search = mysql_real_escape_string($contains);
if(!empty($search)) {
  $search = "%$search%";
}

[siric]

That has nothing to do with injection. Unless passing an empty string can be considered an injection...

 

If I pass

"" OR 1

in the $contains variable, I end up with $searchstring being equal to %% which then displays everything in the table.

 

 

 

 

[Mchl]

If I pass

"" OR 1

in the $contains variable, I end up with $searchstring being equal to %% which then displays everything in the table.

 

Did you ever check it?

 

mysql_connect('localhost','root','');

$contains = '"" OR 1';
$search = mysql_real_escape_string($contains);
$search = "%".$search."%";
echo $search;

 

%\"\" OR 1%

[siric]

Hi,

 

Problem was a misspelling on the variable that I assigned when I did the mysql_real_escape_strring  :-\

 

Working too late at night!!

 

 

Thanks for the help.

[Mchl]

Happens. That's why E_NOTICE error level is so useful