note 92744 added to security.database.sql-injection

Another way to prevent SQL injections as opposed to binary, is to use URL Encoding or Hex Encoding. I haven't seen a complete example of stopping SQL Injections, most refer to use the mysql_real_escape_string function or param statements. Several examples at http://en.wikipedia.org/wiki/SQL_injection Which will stop \x00, \n, \r, \, ', " and \x1a based attacks. Alot depends on your SQL query structure, though vector level attacks are still viable. Other than that build your own regex replacement to protect specific queries that could alter or compromise your database/results for specific sections of your processing pages. Also use unique table and field names. Not just putting _ infront of them... Example, don't store User/s or Customer/s information in a table named the same. And NEVER use the same form field names for database field names. ---- Server IP: 64.71.164.2 Probable Submitter: 12.228.64.18 ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- https://master.php.net/note/edit/92744 Del: integrated -- https://master.php.net/note/delete/92744/integrated Del: useless -- https://master.php.net/note/delete/92744/useless Del: bad code -- https://master.php.net/note/delete/92744/bad+code Del: spam -- https://master.php.net/note/delete/92744/spam Del: non-english -- https://master.php.net/note/delete/92744/non-english Del: in docs -- https://master.php.net/note/delete/92744/in+docs Del: other reasons-- https://master.php.net/note/delete/92744 Reject -- https://master.php.net/note/reject/92744 Search -- https://master.php.net/manage/user-notes.php