zander1983 Posted July 2, 2011 Share Posted July 2, 2011 I've got a market place style site and a friend managed to perform SQL injection on it despite the fact I use mysql_real_escape_string() to escape any dodgy characters. Are there any flaws to this function? I thought it totally eradicated SQL injection.. Quote Link to comment https://forums.phpfreaks.com/topic/240950-does-mysql_real_escape_string-always-prevent-sql-injection/ Share on other sites More sharing options...
Pikachu2000 Posted July 2, 2011 Share Posted July 2, 2011 You've probably not used it properly, misapplied it, or used another function that negates it. Post the code in question, and let's see what's going on with it. Quote Link to comment https://forums.phpfreaks.com/topic/240950-does-mysql_real_escape_string-always-prevent-sql-injection/#findComment-1237626 Share on other sites More sharing options...
PFMaBiSmAd Posted July 2, 2011 Share Posted July 2, 2011 mysql_real_escape_string only protects against sql injection in string data, i.e. data enclosed by single-quotes in a query. For things like numerical data (which is not enclosed by single-quotes in a query), you need to validate/cast the data as a number in order to prevent sql injection, because it is possible to form sql that contains no quotes for which escaping the quotes doesn't do anything because there are no quotes to escape. Quote Link to comment https://forums.phpfreaks.com/topic/240950-does-mysql_real_escape_string-always-prevent-sql-injection/#findComment-1237628 Share on other sites More sharing options...
zander1983 Posted July 2, 2011 Author Share Posted July 2, 2011 For things like numerical data (which is not enclosed by single-quotes in a query), you need to validate/cast the data as a number in order to prevent sql injection, because it is possible to form sql that contains no quotes for which escaping the quotes doesn't do anything because there are no quotes to escape i had not thought about that, this must be the problem, cheers Quote Link to comment https://forums.phpfreaks.com/topic/240950-does-mysql_real_escape_string-always-prevent-sql-injection/#findComment-1237632 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.