How can I secure my PHP queries against SQL injection without using PDO or prepared statements?

Question

i want to secure my sql queries without pdo or prepare statement
can this function do ?

function sql_escape($string)
{
    $string =   iconv(mb_detect_encoding($string),'UTF-8//IGNORE',$string);
    $string =   addslashes($string);
    $string =   preg_replace('/[\x00-\x1F\x80-\xFF\0xB4\0x60\0x96\0x97\0x95\0x94\0x93\0x92\0x91\0x84\0x82\0x3B\0x8A]/', '', $string);
    $string =   addslashes($string);
    return $string;
}

It's not just a matter of security, but of deprecated functions as well. They made [new] good things for you, use them : )) — moonwave99, Jul 02 '13 at 17:20
If you have to use REGEX to even attempt to do data validation (in most scenarios), then you're doing it wrong. `Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems.` - Jamie Zawinski — Rob W, Jul 02 '13 at 17:30
And by data validation, I mean "validating the data is OK for the database"-validation. — Rob W, Jul 02 '13 at 17:32
All you need to do is escape any character the database will interpret as a string terminator or otherwise special character. Everything else is just pointless song and dance with which you're destroying the original value little by little. [The Great Escapism (Or: What You Need To Know To Work With Text Within Text)](http://kunststube.net/escapism/) — deceze, Jul 02 '13 at 20:15

score 4 · Answer 1 · answered Jul 02 '13 at 17:19

4

No, use the supplied escape function. For mysqli this is mysqli_real_escape_string.

Don't reinvent the wheel, especially if it's a very complex wheel and you're not really sure it works in all conditions.

answered Jul 02 '13 at 17:19

Halcyon

57,230
10
89
128

Ops :) ... But i don't like this words " Don't reinvent the wheel " I just wanna to learn more and more ! – Mohammed Al Ashaal Jul 02 '13 at 17:29
I wonder why this answer is so upvoted. mysqli_real_escape_string do not protect anything from SQL injection. – Your Common Sense Jul 02 '13 at 20:38

score -1 · Answer 2 · answered Jul 02 '13 at 20:40

-1

Like many PHP folks you are confusing escaping with protection from injection. So, someday your site will be hacked and you'll come here ready to learn something useful at last.

answered Jul 02 '13 at 20:40

Your Common Sense

156,878
40
214
345

How can I secure my PHP queries against SQL injection without using PDO or prepared statements?

2 Answers2