Re: How to improve sql query security using php?

At 03:41 AM 9/30/00 -0700, Mike Glover of <mpg4@duluoz.net> eloquently postulated: <a very BIG snip was here> >In short, what's >stopping an attacker from running: > > > http://your.page/script.php?userstable=secrettable&emailfield=<hex > code >for *> > >to access your secret data? Best of luck. > >-mike and Cary thus sayth: "You should use substr or preg_replace to escape or get rid of characters you know you don't want. The big ones you will want to get rid of, or escape are of course \, _, %, " and ' (the apostrophe). You can use addslashes to escape ", ' and \. Cary >_____________________________________ Ahhhh! Yes, this is what I need help with ... Thanks to Mike Glover of <mpg4@duluoz.net> and also thanks to Cary Collett <cary@ratatosk.org> for their kind and expeditious help. So, if I use a specified name for the field, and a CONSTANT for the table name, and use quotemeta($myvar) individually on all the form field values to be passed to the sql select, and then used: $query = verifyData($query); where this function is declared: function verifyData ($query) { if($query){ $query = str_replace ("%", "", $query); $query = str_replace ("_", "", $query); /* quotemeta($str) is presumed to be used at the user form value // quotemeta() returns a backslash character (\) before every character // that is among these: . \\ + * ? [ ^ ] ( $ ) /* return $query; }else{ exit; } } How could the combination of quotemeta() and verifyData() , or verifyData itself be improved for: SELECT email, password FROM TABLENAME WHERE email ='$loginemail' Or have we arrived at a secure state - I still don't see the fix for the original: http://your.page/script.php?userstable=secrettable&emailfield=<hex code for *> ??? Richard Creech http://dreamriver.com richardc@dreamriver.com Phone 250.744.3350 Pacific Time