Boolean searches and sql injection.

[rcorlew]

Currently I am using mysql_real_escape_string help stop sql injection, but I am running a boolean search that explodes the input into an array. Each space separated item/word  is an item in the array, and then it is queried with the following code:

 

<?php
$query = "SELECT id, title, location, page_text, MATCH(title,page_text) AGAINST('+$expanded[0] ~$expanded[1] ~$expanded[2] ~$expanded[3]' IN BOOLEAN MODE) AS score FROM pages WHERE MATCH (title,page_text) AGAINST ('+$expanded[0] ~$expanded[1] ~$expanded[2] ~$expanded[3]' IN BOOLEAN MODE)  ORDER BY score DESC";
?>

 

My question is this, isn't the boolean search itself removed from the threat of sql inection with out having to escape anything?

[fenway]

No.... everything is at risk

[rcorlew]

That is what I was thinking, so I added the escape string to start off with, I just wish I could figure out how to not escape things like 's  and 't , which are things which would be searched for on this site for example ..

 

Crohn’s disease

 

I am sure that I can add that to the real-escape_string parameters like many other thinks like string functions.

[fenway]

That is what I was thinking, so I added the escape string to start off with, I just wish I could figure out how to not escape things like 's  and 't , which are things which would be searched for on this site for example ..

 

Crohn’s disease

 

I am sure that I can add that to the real-escape_string parameters like many other thinks like string functions.

 

I don't understand... how is escaping a problem for you?

[rcorlew]

It's not a problem except for the fact that my new web host has some rather odd security features in place.

 

For instance:

 

If you post an apostrophe into sql it turns it into this ’, I have written a function to replace all forms of characters so I should not face this again.

 

I am about to drop this web host, they have some insane security features that inherently make sites less secure, so I am on the lookout.

 

But that is for another topic anyway.

[fenway]

If you post an apostrophe into sql it turns it into this ’, I have written a function to replace all forms of characters so I should not face this again.

 

Sounds like a fancy quote from Word or some other rich-text program.