Re: Entering a query
| From: | billy chan | Date: | Thu, 17 Apr 2003 09:03:49 +0000 |
| Subject: | Re: Entering a query | ||
| References: | 1 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-27133@lists.php.net to get a copy of this message | ||
[Tue, 15 Apr 2003 15:23:20 +0100] Shaun <shaun@mania.plus.com>
wrote:
> I have a form on my page that lets a user enter a query to
> the database, how
> can I ensure that the user only enters 'SELECT' statements and
> therefore
> doesn't drop the whole database or do anything else malicious?
How about trying to catch the offending word.
if
(preg_match("/\b(delete|drop|alter|insert|replace)\b/i",$querystr
ing)) {
// redirect to error message
}
else {
// execute query & display results
}
I think a better solution is to create a new user and grant that
user only the right to select against that particular database.