How to prevent SQL injection in PHP?

[jackhard]

If user input is inserted into an SQL query directly, the application becomes vulnerable to SQL injection, like in the following example:

$unsafe_variable = $_POST['user_input'];

mysql_query("INSERT INTO table (column) VALUES ('" . $unsafe_variable . "')");

That's because the user can input something like value'); DROP TABLE table;--, making the query:

INSERT INTO table (column) VALUES('value'); DROP TABLE table;--')

What should one do to prevent this?

 

[trq]

For starters, the mysql extension has been deprecated in favour of mysqli or PDO. Both of which support prepared statements.

 

If you really must use the mysql extension, take a look at mysql_real_escape_string at least.

[jugesh]

Here is a nice article on SQL Injection.Please go through the link.

 

http://www.veracode.com/security/sql-injection