note 71615 added to function.odbc-exec

A determined attacker will easily jump through whatever string-escaping hoops you can devise. A better way to protect yourself against SQL injection is to bind your parameters, which requires calling odbc_prepare() and odbc_execute(): <?php $emp_id = $_GET['emp_id']; $stmt = odbc_prepare($db_conn, "SELECT pwd FROM employees WHERE emp_id=?"); $res = odbc_execute($stmt, array($emp_id)); ?> This should compile the SELECT statement so that the parameter 'emp_id' is never included as part of your literal SQL query; i.e., it prevents your end users from "contributing" to your code. But of course even the above is not good enough; see particularly the warning about single-quote-delimited strings in odbc_execute()'s parameters array: http://www.php.net/manual/en/function.odbc-execute.php It's paramount that you validate user-supplied parameters, always and everywhere -- and keep in mind that every query-variable from a GET or POST should be considered "user-supplied", even if it's in a hidden input field on the front-end web page and the average browser user has no control over it. Take the above example, and suppose that the backend database uses a two-byte unsigned numeric field to store 'emp_id'. In that case, then you must make sure, before you do anything with ODBC, that 'emp_id' is indeed numeric, positive, and <= 65535. If it's not, assume an attack and fail with an ambiguous error message. If you trust user input without checking it yourself, you're asking to be hacked. Here's a nice intro to SQL-injection: http://www.unixwiz.net/techtips/sql-injection.html ---- Server IP: 216.194.113.175 Probable Submitter: 71.130.64.166 ---- Manual Page -- http://www.php.net/manual/en/function.odbc-exec.php Edit -- https://master.php.net/note/edit/71615 Del: integrated -- https://master.php.net/note/delete/71615/integrated Del: useless -- https://master.php.net/note/delete/71615/useless Del: bad code -- https://master.php.net/note/delete/71615/bad+code Del: spam -- https://master.php.net/note/delete/71615/spam Del: non-english -- https://master.php.net/note/delete/71615/non-english Del: in docs -- https://master.php.net/note/delete/71615/in+docs Del: other reasons-- https://master.php.net/note/delete/71615 Reject -- https://master.php.net/note/reject/71615 Search -- https://master.php.net/manage/user-notes.php