Shadowing Posted January 6, 2012 Share Posted January 6, 2012 been wondering about this for a while do I need to put the escape on each WHERE? or do i really only need to put it on the $_POST i can probably understand why i need it on $_GET also after WHERE. So wondering about the session id. <?php mysql_query("UPDATE systems SET homes= $homes + '".mysql_real_escape_string($_POST['homes'])."' WHERE address = '".mysql_real_escape_string($_GET['planet'])."' AND id = '".($_SESSION['user_id'])."'"); ?> Link to comment https://forums.phpfreaks.com/topic/254472-question-on-mysql-injection/ Share on other sites More sharing options...
Shadowing Posted January 6, 2012 Author Share Posted January 6, 2012 Quote been wondering about this for a while do I need to put the escape on each WHERE? or do i really only need to put it on the $_POST i can probably understand why i need it on $_GET also after WHERE. So wondering about the session id. <?php mysql_query("UPDATE systems SET homes= $homes + '".mysql_real_escape_string($_POST['homes'])."' WHERE address = '".mysql_real_escape_string($_GET['planet'])."' AND id = '".($_SESSION['user_id'])."'"); ?> Link to comment https://forums.phpfreaks.com/topic/254472-question-on-mysql-injection/#findComment-1304782 Share on other sites More sharing options...
trq Posted January 6, 2012 Share Posted January 6, 2012 All user provided data needs to be validated and escaped before using it in any query. Link to comment https://forums.phpfreaks.com/topic/254472-question-on-mysql-injection/#findComment-1304786 Share on other sites More sharing options...
Shadowing Posted January 6, 2012 Author Share Posted January 6, 2012 thats why i was thinking i wouldnt need it on the 2nd WHERE matching session id since its not matching something a user could insert is my way of thinking about that correct? Link to comment https://forums.phpfreaks.com/topic/254472-question-on-mysql-injection/#findComment-1304800 Share on other sites More sharing options...
PaulRyan Posted January 6, 2012 Share Posted January 6, 2012 Yes that is correct. Link to comment https://forums.phpfreaks.com/topic/254472-question-on-mysql-injection/#findComment-1304842 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.