RE: [PHP] Filtering (was storing single and double quote in MySQL)

At 11:51 PM +0100 5/25/06, Chrome wrote:

[snip] 1. Anytime you put anything into a dB then use mysql_real_escape_string() function. If you are NOT going to put it in a dB, then you don't need mysql_real_escape_string() function -- understand? [/snip] Untrue... It isn't just inserting into a DB that requires this function... Consider: User enters: anything'; DROP TABLE x; SELECT 'a' = 'a into the form for username... Now your unescaped SQL statement reads: UPDATE members SET status='live' WHERE Username = 'anything'; DROP TABLE x; SELECT 'a' = 'a' Where x can be a brute-forced table name... I can't remember if MySQL allows multiple statements but I seem to remember hearing that MySQL5 does... If I'm wrong correct me and tell me to RTFM :) Nice catch on the error... I didn't notice that :) HTH (and that I'm right :) ) Dan

Dan: A couple of things: One, I'm not sure if afan understands multiple statements, so I didn't want to confuse him; Two, I don't use multiple statements because they confuse me. I'm much more of a step-by-step programmer. I find that sometimes it's best to provide something simple for someone to learn rather than confuse them with remote possibilities. I taught at college level and believe me when I say there is nothing dumber than a student. Baby steps are best -- and the same for me when I'm learning as well. In the exchange I had with afan, we were talking about placing data into a dB without the need for escapes and I think the advice I gave him was correct. I realize that there are exceptions to just about anything IF you dig deep enough. For example did you know that if magic_quotes are turned ON and you use escape_data() that function will use mysql_real_escape_string(). So, here's an example that proves your point, but if I was to inform afan of that, what good would it do? Knowing that hasn't done anything for me. In any event, your point is well taken -- thanks for the clarification. tedd -- ------------------------------------------------------------------------------------ http://sperling.com http://ancientstones.com http://earthstones.com