Is this PHP approach safe?

Question

I want to send a number of parameters from an application to a database table through PHP. I use the 'GET' method and want to set some restrictions to the variables and/or in some way make it safe as in the approach below. The good thing is that they can only contain greek letters, numbers and the .-, symbols.

Is this doing it correctly?

FORM:

<input type="text" name="a">
<input type=text" name="b">

URL:

http://the url.php?a=4,52&b=αβγδ.,-12345

What I want it to do, simply:

Show rows where id=x if the user sends an existing id and the correct key that is defined in the PHP file.

Safe approach [edited]:

$dbh=db_conn();

$vara = mb_convert_encoding($_GET["a"], 'UTF-8', 'ISO-8859-7');
$varb = mb_convert_encoding($_GET["b"], 'UTF-8', 'ISO-8859-7');

$sqlb = $dbh->prepare("SELECT * FROM table WHERE id = ? AND $vara='myknowkey';");

$sqlb->execute($varb);

Why are you substituting `$_GET['a']` straight into the SQL rather than having it as a parameter like `$_GET['b']`? — IMSoP, Feb 15 '14 at 16:29
@IMSoP Because you can't use prepared statements to place a condition on an arbitrary column. — Niet the Dark Absol, Feb 15 '14 at 16:29
@NiettheDarkAbsol I thought that might be the intention, but it doesn't make sense with the example given, where `$_GET['a']` is `'4,52'`. — IMSoP, Feb 15 '14 at 16:31
True, I agree, it doesn't make much sense. But at least that should explain why they're trying to do this... hopefully! — Niet the Dark Absol, Feb 15 '14 at 16:31
@YourCommonSense `$dbh->prepare()` sure looks like a Prepared Statement to me. Not the most *useful* tag, but not completely irrelevant. — IMSoP, Feb 15 '14 at 16:31
Sidenote: You have a typo `` missing quote `` so that will throw an error, in case that is your actual code. Notice SO's syntax highlighting? ;-) — Funk Forty Niner, Feb 15 '14 at 16:32

score 5 · Answer 1 · answered Feb 15 '14 at 16:29

5

no, $_GET[a]='myknowkey' can inject code to your sql statement

answered Feb 15 '14 at 16:29

Dima

8,586
4
28
57

Is this PHP approach safe?

1 Answers1