Semicolons in PHP form submissions

Question

Two related questions that should be easy, though my searching has come up empty.

I have a from in PHP. If a field has a semi-colon in it, and I do a dump of $_POST in the action page, the field value is truncated at the semi-colon. I'm guessing this is related to SQL injection security? But legitimate semi-colons need to be allowed. Is there a setting that allows this to go through? Or do I need to escape it, and if so, how?
To catch actual SQL injections, I don't need to allow multiple statements in one query... like "SELECT * FROM table;DROP table". Is there a setting that disables this, either in PHP or MySQL, but without stopping legitimate semicolons?

I've never heard of semicolons being a problem. Can you show an example of what you're inputting? — Niet the Dark Absol, Apr 27 '13 at 02:59
Also, you don't need to detect SQL injections, you need to make all input benign. — Niet the Dark Absol, Apr 27 '13 at 03:00
I don't have an answer for question 1 yet, but as for 2, what you can do is use prepared statements. — Chris Forrence, Apr 27 '13 at 03:00

score 1 · Answer 1 · edited May 23 '17 at 11:49

semi-colons does not cause any problem.

Use prepared statements.

$stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?');
$stmt->bind_param('s', $name);

$stmt->execute();

$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // do something with $row
}

In PDO:

$stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name');

$stmt->execute(array(':name' => $name));

foreach ($stmt as $row) {
    // do something with $row
}

Use mysql_real_escape_string

$unsafe_variable = $_POST["user-input"];
$safe_variable = mysql_real_escape_string($unsafe_variable);

mysql_query("INSERT INTO table (column) VALUES ('" . $safe_variable . "')");

Check this question for more information How can I prevent SQL injection in PHP?

score 0 · Answer 2 · answered Apr 27 '13 at 03:44

Ok, silly me. Yes, I am using prepared statements, escaping, etc. But I also wanted to sanitize the input before it even gets that far. So I have a global function that checks all parameters, taking out anything following apostrophes and semicolons. Works fine for GET values, but I forgot that I needed to update that to handle POST parameters differently, and had forgotten this was there, as I hadn't type a semi-colon until now. :) But thanks for the responses.

Semicolons in PHP form submissions

2 Answers2