note 82481 added to function.mysql-query
| From: | mjburford at gmail dot com | Date: | Sat, 12 Apr 2008 22:00:18 +0000 |
| Subject: | note 82481 added to function.mysql-query | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-138241@lists.php.net to get a copy of this message | ||
After one stupid copy-paste mistake and a restored backup, I changed all the mysql_query functions
to go thru a "stupid mistake" checker. The SQL injection checks likely could be better
too.
function SafeMySqlQuery($sql) {
global $link_id;
if (stripos($sql, "UPDATE")===0 && stripos($sql, "WHERE")===false) {
die("Update with no WHERE!!!");
} elseif (stripos($sql, "DELETE")===0 && stripos($sql,
"WHERE")===false) {
die("Delete with no WHERE!!!");
} elseif (stripos($sql, "SELECT")===0 && (stripos($sql, "INSERT
INTO")>0 || stripos($sql, "DELETE FROM")>0 || stripos($sql, "CREATE
TABLE")>0)) {
die("SQL Injection Attack???");
} else {
return mysql_query($sql, $link_id);
}
}
----
Server IP: 208.69.120.35
Probable Submitter: 24.19.35.186
----
Manual Page -- http://www.php.net/manual/en/function.mysql-query.php
Edit -- https://master.php.net/note/edit/82481
Del: integrated -- https://master.php.net/note/delete/82481/integrated
Del: useless -- https://master.php.net/note/delete/82481/useless
Del: bad code -- https://master.php.net/note/delete/82481/bad+code
Del: spam -- https://master.php.net/note/delete/82481/spam
Del: non-english -- https://master.php.net/note/delete/82481/non-english
Del: in docs -- https://master.php.net/note/delete/82481/in+docs
Del: other reasons-- https://master.php.net/note/delete/82481
Reject -- https://master.php.net/note/reject/82481
Search -- https://master.php.net/manage/user-notes.php