Re: Using mysql_real_escape_string without connecting to mysql
| From: | Dotan Cohen | Date: | Thu, 24 Jan 2008 16:01:51 +0000 |
| Subject: | Re: Using mysql_real_escape_string without connecting to mysql | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-268003@lists.php.net to get a copy of this message | ||
On 24/01/2008, Jochem Maas <jochem@iamjochem.com> wrote:
> > Which basically is the same as a simple mysql_real_escape_string? In
> > other words, mysql_real_escape_string itself is safe from SQL
> > injection?
>
> not exactly - it assumes you will use the value as a quoted string in a query.
>
> $s = clean_mysql("foo -- bar ; ' qux")
> $q = "INSERT INTO foo (bar) VALUES ('$s')";
Ah, we've gotten to the meat. So long as there as single quotes around
the data that has gone through mysql_real_escape_string there is no
danger of SQL injection? So this is safe:
mysql_query("
INSERT INTO
foo (bar)
VALUES (
'".mysql_real_escape_string($evilString)."'
)");
Dotan Cohen
http://what-is-what.com
http://gibberish.co.il
א-ב-ג-ד-ה-ו-ז-ח-ט-י-ך-כ-ל-ם-מ-ן-נ-ס-ע-ף-פ-ץ-צ-ק-ר-ש-ת
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?