php security for GET command using on queries WHERE.....

[dsaba]

Hey I am doing mysql queries based on WHERE fieldname='$_GET['variable'];

 

I know this is a big security risk with sql injection etc...

so i have implemented this code, I want to know if this is sufficient in protecting against any kind of xss or sql injection attack attempt

 

<?php

$lang = $_GET['lang'];
$userid = $_GET['id'];

//filter userid if userid is not numeric then die()
$filteruserid = preg_match("/[A-Za-z<>;()!@#$%&*'?.,+=-_~]/", $userid);
// ;()!@#$%&*
if ($filteruserid > 0) {
die("user not found");
}

//if lang is not lowercase a-z then die
$filterlang = preg_match("/[A-Z0-9<>;()!@#$%&*'?.,+=-_~]/", $lang);
// ;()!@#$%&*
if ($filterlang > 0) {
die("language not found");
}

?>

 

so is that good enough? or what else can I do?-thanks

[neel_basu]

If GPC Is on And Some ine do this http://ww.yourdomain.com/yourpage.php?filteruserid=0&filterlang=0 He May not harm you at all Cause preg_match is overwritting it.(assuming that You have cheaked wheather lang and id is submitted) But I would Suggest You To Paste this .htaccess file In that folder where the page is.

php_flag register_globals Off

Also Do this before sending the query.

mysql_real_escape_string($id)

 

[attachment deleted by admin]