0

I'm starting to think about protecting my inputs from SQL injection. I've read about PDO and mysqli and will be using those techniques. While I was researching protection against SQL injection, I had a thought about a technique. Whenever I have an input from a user, I could scan the input string and search for occurrences of "'" or "DROP" and if the string contains those characters, then I could just not proceed. Would this technique prevent a lot of SQL injection?

Thanks for your help.

Jon Rubins
  • 4,323
  • 9
  • 32
  • 51
  • Using PDO alone will prevent any injection since you're going to use prepared statements. There's simply no need to do anything further. – ccKep May 11 '12 at 23:45
  • 1
    The best way to prevent SQL injections described here http://stackoverflow.com/questions/60174/best-way-to-stop-sql-injection-in-php – itsmeee May 11 '12 at 23:48

5 Answers5

4

It is best to go with methods which have gone through rigorous testing before hand, and not try to implement your own.

A problem with your desired solution is, what happens when SQL add a new notation for dropping tables? Or what if they use 'truncate' instead? This is not foolproof.

AlanFoster
  • 8,156
  • 5
  • 35
  • 52
3

Just use PDO or SQLi.

If used correctly and as intended, both will stop it; it'd be silly to use a measure like stopping the word DROP -- Imagine if someone types 'dropbox,' for example?

Ashley Davies
  • 1,873
  • 1
  • 23
  • 42
  • Actually neither will completely stop it, prepared statements and data validation must be performed and even then it isn't always 100% safe there is still a possibility if not all parts of the application follow these requirements. – mhvvzmak1 May 12 '16 at 20:47
2

You should escape your input, and consider using prepared statements. This will remove nearly all SQL injection weaknesses. Scanning for specific words is a terrible practice, as it generally annoys legit users, and doesn't stop determined hackers.

Mitch Dempsey
  • 38,725
  • 6
  • 68
  • 74
1

Try to use only prepared statement. It one of the best technique ever.

http://php.net/manual/pt_BR/pdo.prepared-statements.php

Tiago Peczenyj
  • 4,387
  • 2
  • 22
  • 35
-1

The best way is to validate all user input against strict patterns to ensure no user data is abnormal, along with PDO prepared statements - this way you may also prevent XSS however it is usually beneficial to sanitize all user generated output as well just in case you didn't properly validate something and a user is able to execute malicious code.

mhvvzmak1
  • 307
  • 2
  • 12
  • Why was this answer down voted? Obviously some amateur as this is the real way to validate data integrity and ensure safe manipulation, all major developments use this pattern. – mhvvzmak1 May 12 '16 at 15:52