Re: Filtering (was storing single and double quote in MySQL)

tedd wrote:

At 11:51 PM +0100 5/25/06, Chrome wrote:

[snip] 1. Anytime you put anything into a dB then use mysql_real_escape_string() function. If you are NOT going to put it in a dB, then you don't need mysql_real_escape_string() function -- understand? [/snip] Untrue... It isn't just inserting into a DB that requires this function... Consider: User enters: anything'; DROP TABLE x; SELECT 'a' = 'a into the form for username... Now your unescaped SQL statement reads: UPDATE members SET status='live' WHERE Username = 'anything'; DROP TABLE x; SELECT 'a' = 'a' Where x can be a brute-forced table name... I can't remember if MySQL allows multiple statements but I seem to remember hearing that MySQL5 does... If I'm wrong correct me and tell me to RTFM :) Nice catch on the error... I didn't notice that :) HTH (and that I'm right :) ) Dan

Dan: A couple of things: One, I'm not sure if afan understands multiple statements, so I didn't want to confuse him; Two, I don't use multiple statements because they confuse me. I'm much more of a step-by-step programmer.

Dan was giving you an example of a really bad sql injection attack where instead of one query: select * from members where email='email_address'; you end up with three: select * from members where email='anything'; DROP TABLE x; SELECT 'a' = 'a'; The point being never trust user data - always escape it whether you're inserting, updating, deleting or selecting. Using mysql_real_escape_string or your db's equivalent means it becomes only one query (which won't return any results, but stops your data from being destroyed). Multiple statements means running multiple queries within the same function call: so mysql_query("select * from members where email='anything'; DROP TABLE x; SELECT 'a' = 'a';"); is actually 3 sql statements (select, drop table, select), but only one call to mysql_query. Whether mysql_query allows this to happen is another thing and one left to the readers to check. -- Postgresql & php tutorials http://www.designmagick.com/