Is this function enough for preventing SQL Injection?

Asked Apr 19 '20 at 08:01

Active Apr 19 '20 at 08:05

Viewed 61 times

I created this simple function and want to know that if it is enough for preventing SQL Injection.

$sub_username = encr(mysqli_real_escape_string($conn, $_POST['username']));
$sub_password = encr(mysqli_real_escape_string($conn, $_POST['password']));

$sql = "SELECT password FROM login WHERE username='$sub_username'";
$result = mysqli_query($conn, $sql);


function encr($data) {
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
}

asked Apr 19 '20 at 08:01

ahmedg

4

Why not just use prepared statements? Much easier than mangling your input... – Niet the Dark Absol Apr 19 '20 at 08:04
[How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1) – brombeer Apr 19 '20 at 08:04
1

Does this answer your question? [How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – compuphys Apr 19 '20 at 08:05
I know, but I wanted to ask if it can work. – ahmedg Apr 19 '20 at 08:06
1

I would also recommend using `password_hash()`. – Nigel Ren Apr 19 '20 at 08:06
2

well, if you want to know. This code is just a random heap of function calls that is incidentally prone to SQL injection.You got to use prepared statements because they won't let an SQL injection in, no matter what you do. – Your Common Sense Apr 19 '20 at 08:28
What do you think htmlspecialchars does, and why do you think it would help with SQL injection? – iainn Apr 19 '20 at 08:31
It's not only not enough. It's actually counterproductive, since it undos the escaping when used in this combination. – mario Apr 19 '20 at 08:46
mysqli_real_escape_string wont protect from `1 or 1=1` – Lawrence Cherone Apr 19 '20 at 09:42
Ok, I understand. Thanks for your help! – ahmedg Apr 20 '20 at 10:18

Is this function enough for preventing SQL Injection?

0 Answers0