Is mysql_real_escape_string enough to Anti SQL Injection?

Question

In PHP Manual, there is a note:

Note: If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks.

Is this enough to anti sql injection? If not, could you give an example and a good solution to anti sql injection?

See [Does mysql_real_escape_string() FULLY protect against SQL injection? ](http://stackoverflow.com/questions/1220182/does-mysql-real-escape-string-fully-protect-against-sql-injection). — Matthew Flaschen, Nov 13 '10 at 05:31

deceze · Accepted Answer · 2013-07-16T18:21:12.547

9

mysql_real_escape_string is usually enough to avoid SQL injection. This does depend on it being bug free though, i.e. there's some small unknown chance it is vulnerable (but this hasn't manifested in the real world yet). A better alternative which completely rules out SQL injections on a conceptual level is prepared statements. Both methods entirely depend on your applying them correctly; i.e. neither will protect you if you simply mess it up anyway.

edited Jul 16 '13 at 18:21

answered Nov 13 '10 at 05:31

deceze

510,633
85
743
889

1

just to clarify: there is also a chance that PDO emulates prepared queries (for mysql) and doesn't use native mysql ones. There is no such declaration in php documentation (or I cannot found one). – zerkms Nov 13 '10 at 06:49
"PDO will emulate for drivers that don't support them" --- is not enough, because: a) installed (old) libmysql can don't support prepared; b) PDO still can don't use native prepared statements. – zerkms Nov 13 '10 at 06:51

score 0 · Answer 2 · answered Nov 13 '10 at 05:28

0

As far as i know this is a solid way to avoid SQL Injection attacks.

answered Nov 13 '10 at 05:28

mcbeav

11,893
19
54
84

Sorry forgot to add, that i think you can attack from a URL. – mcbeav Nov 13 '10 at 05:29
You can also, always restrict who can access what on your database, and who has what privileges. – mcbeav Nov 13 '10 at 05:31

score -1 · Answer 3 · edited Feb 16 '18 at 14:04

-1

The best solution is PDO.

If you're using the traditional mysql_query then running all of your data through mysql_real_escape_string() is enough.

edited Feb 16 '18 at 14:04

Rotimi

4,783
4
18
27

answered Nov 13 '10 at 05:30

user229044

232,980
40
330
338

Parameterized queries are also available in the `PDO` extensions – bcosca Nov 13 '10 at 05:32

Is mysql_real_escape_string enough to Anti SQL Injection?

3 Answers3

Linked