note 111997 deleted from function.filter-input by googleguy
| From: | googleguy@php.net | Date: | Sat, 20 Apr 2013 00:09:53 +0000 |
| Subject: | note 111997 deleted from function.filter-input by googleguy | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-194573@lists.php.net to get a copy of this message | ||
Note Submitter: llange
----
I believe "travismowen" is wrong (RAW data = SQL injection ?!) !
You must "filter" any input data (GET, POST, COOKIE, ...).
mysqli->real_escape_string is a pain as you need to open a DB connection.
Therefore I would recommend the following to create a SQL query either use :
<?php mysqli->real_escape_string(string $var|$_INPUT); ?>
http://www.php.net/manual/en/mysqli.real-escape-string.php
Or :
<?php mysqli->prepare(string $var); & mysqli_stmt->bind('i|d|s|b',mixed
&$vars...) ?>
http://php.net/manual/en/mysqli.prepare.php
And to use in PHP (especially when writing files) filter-input seems enough...
Another good practice is to disable server HTML feed-back on errors.
<?php
ini_set('display_errors',(GET DEVELOPPER IP OR SOME KIND OF CREDENTIALS TO BE
TRUE?'On':'Off'));
?>
http://php.net/manual/en/function.ini-set.php
You may also apply such filter on the server side (eg. mod_ext_filter). If you manage the server(s)
on which your script(s) will be installed.