note 82481 deleted from function.mysql-query by felipe
| From: | felipe@php.net | Date: | Sat, 12 Apr 2008 23:01:39 +0000 |
| Subject: | note 82481 deleted from function.mysql-query by felipe | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-138247@lists.php.net to get a copy of this message | ||
Note Submitter: mjburford at gmail dot com
----
After one stupid copy-paste mistake and a restored backup, I changed all the mysql_query functions
to go thru a "stupid mistake" checker. The SQL injection checks likely could be better
too.
function SafeMySqlQuery($sql) {
global $link_id;
if (stripos($sql, "UPDATE")===0 && stripos($sql, "WHERE")===false) {
die("Update with no WHERE!!!");
} elseif (stripos($sql, "DELETE")===0 && stripos($sql,
"WHERE")===false) {
die("Delete with no WHERE!!!");
} elseif (stripos($sql, "SELECT")===0 && (stripos($sql, "INSERT
INTO")>0 || stripos($sql, "DELETE FROM")>0 || stripos($sql, "CREATE
TABLE")>0)) {
die("SQL Injection Attack???");
} else {
return mysql_query($sql, $link_id);
}
}