note 75705 rejected from function.gethostbyaddr by nlopess
| From: | nlopess@php.net | Date: | Tue, 19 Jun 2007 12:35:57 +0000 |
| Subject: | note 75705 rejected from function.gethostbyaddr by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-127780@lists.php.net to get a copy of this message | ||
Note Submitter: zoisite at bluebottle dot com
----
I wonder if "SQL injection" is possible with a hostname.
Does anyone know that, is it possible to manipulate a dns server to respond a domain name which
contains an sql statement which allows sql injection?
Example:
$host = gethostbyaddr($_SERVER['REMOTE_ADDR']);
mysql_query("INSERT INTO
table (host) VALUES
('".$host."')");
Do we need addslashes? :
$host = addslashes(gethostbyaddr($_SERVER['REMOTE_ADDR']));
Thanks for the answer