How does this look for sanitizing mysqli input?

Question

Based on http://us.php.net/manual/en/filter.filters.sanitize.php , this looks like a good way for my purposes:

$filteredVar = filter_var($myVar, FILTER_SANITIZE_STRING);

The strings I will be inserting to my db will be addresses, dates, prices, and product names, all from db or generated by jquery datepicker or google maps api.

Thanks for the suggestion! No wonder my patent for the wheel was turned down. — user1877124, Aug 25 '14 at 00:18
MySQLi has prepared statements, what is your issue with those? — Marty, Aug 25 '14 at 00:20
http://stackoverflow.com/a/14303765/1877124 seemed like a well-considered answer. But maybe PDO is the way to go after all. — user1877124, Aug 25 '14 at 00:23

score 0 · Answer 1 · answered Aug 25 '14 at 00:21

0

Why not use prepared Statements. Easier, cleanier and self-maintaining.

$mysqli = new mysqli("","","","");
$mysqli->prepare("SELECT Cols FROM Table WHERE Col=?");
$mysqli->bind_param(...);

answered Aug 25 '14 at 00:21

Daryl Gill

5,464
9
36
69

SamT · Accepted Answer · 2014-08-25T00:27:23.430

0

Please use prepared statements.

CRUD application example for a record creation use-case:

$db = new mysqli();

$name = htmlspecialchars($_REQUEST['product_name']);
$desc = htmlspecialchars($_REQUEST['product_desc']);
$price = htmlspecialchars($_REQUEST['product_price']);

$sql = 'INSERT INTO products (name, description, price) 
    VALUES (?, ?, ?);';
$stmt = $db->prepare();
$stmt->bind_param('ssd', $name, $desc, $price);
$stmt->execute();

edited Aug 25 '14 at 00:27

answered Aug 25 '14 at 00:21

SamT

10,374
2
31
39

Your answer uses a MySQL reserved word `desc` - http://dev.mysql.com/doc/refman/5.5/en/reserved-words.html - this will throw an error. – Funk Forty Niner Aug 25 '14 at 00:26
The placeholders should have been `?` anyway. I fixed it. – SamT Aug 25 '14 at 00:28
No, I meant the column name. – Funk Forty Niner Aug 25 '14 at 00:28
Thanks for your clear, informative answer. I'm taking your advice. – user1877124 Aug 25 '14 at 00:40

How does this look for sanitizing mysqli input?

2 Answers2