Sql Injections???

[Pancake]

Is it just me, or is there nothing wrong with inserting $_POST and $_GET variables into SQL queries? I've seen a lot of:

mysql_query("SELECT * FROM users WHERE username='" . $_POST['username'] ."'");

 

because can't a user send along:

foo' OR 1=1 --

 

It seems like we are teaching new people to rely on Magic_quotes 

[KrisNz]

If you're asking if its o.k to do that, then no its not. Haven't you answered your own question on this one?

[kickassamd]

i recommend that you use addslashes() or mysql_real_escape_string().

[teng84]

i guess putting the '' on your condition makes that a bit safe

if ever the user input wrong data it will give them an error and stop the query

 

so you or 1=1 will not affect your query it will just treat or 1=1 as string..

 

but if you dont put '' it would be very un safe i can even delete your table or db

 

edited.. i don't recommend using get or post directly it is still better to filter your variable before processing

 

[Pancake]

I know how to escape them. I probably was not conveying my point very clearly.

 

Lately, I've seen newer people post code that uses $_POST directly in their SQL statements, and I've seen almost nobody point it out.

 

Anyway, best method (I think(:

function escapeString($str) {
    if(get_magic_quotes_gpc())
        $str = stripslashes($str)

    return mysql_real_escape_string($str);
}

[Pancake]

Examples

- http://www.phpfreaks.com/forums/index.php/topic,177199.0.html

- http://www.phpfreaks.com/forums/index.php/topic,177132.0.html (I'm assuming cpg_db_query doesn't auto-escape queries?)

[trq]

Personally, I get a bit tired of pointing it out. Most people won't listen anyway, its the same as telling people thay should check there queries succeeded prior to attempting to use the results. Most newcomers just wan't to get the thing working, they don't care how reliable/safe its going to be.

[Pancake]

Ahh.. you have a good point there.. I've only been on this forum for so long 

[EchoFool]

Is it just me, or is there nothing wrong with inserting $_POST and $_GET variables into SQL queries? I've seen a lot of:

mysql_query("SELECT * FROM users WHERE username='" . $_POST['username'] ."'");

 

because can't a user send along:

foo' OR 1=1 --

 

It seems like we are teaching new people to rely on Magic_quotes 

 

I have done it ... but you have to do :

 

{$_POST['username']} thats what i did and it worked.

[Pancake]

"INSERT INTO ... WHERE username='". $_POST['username'] ."'"

 

is the same as

 

"INSERT INTO ... WHERE username="{$_POST['username']}"