note 86324 added to security.database.sql-injection

dark dot avenger at email dot cz wrote: "I think that easy way to protect against SQL injection is to convert inputted data into binary format, so that whatever input is, in sql query it will consist only of 1s and 0s." Unless there is a 1-to-1 correspondence between your inputted data and the characters in your 'binary' format, a SELECT query wouldn't work anymore. Not a binary format, but it makes my point: MIME encoding the text 'Dark Avenger' results in 'RGFyayBBdmVuZ2Vy'. If I wanted to look up anyone with 'Avenger' in his/her name, then 'Avenger' would be encoded as 'QXZlbmdlcg==' which clearly wouldn't result in a hit on 'RGFyayBBdmVuZ2Vy'. If there IS a 1-to-1 correspondence, then EITHER your solution only makes it a bit harder to perform a SQL injection (a hacker would have to figure out what mapping was used between the text and the 'binary' format), OR you've come up with simply another way to escaping your data. Either isn't a terribly good solution to the SQL injection problem. ---- Server IP: 69.147.83.197 Probable Submitter: 213.93.155.227 ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- https://master.php.net/note/edit/86324 Del: integrated -- https://master.php.net/note/delete/86324/integrated Del: useless -- https://master.php.net/note/delete/86324/useless Del: bad code -- https://master.php.net/note/delete/86324/bad+code Del: spam -- https://master.php.net/note/delete/86324/spam Del: non-english -- https://master.php.net/note/delete/86324/non-english Del: in docs -- https://master.php.net/note/delete/86324/in+docs Del: other reasons-- https://master.php.net/note/delete/86324 Reject -- https://master.php.net/note/reject/86324 Search -- https://master.php.net/manage/user-notes.php