6

I'm new to PHP, and not yet familiar with how this works.

  1. If I use mysqli_real_escape_string() and parameterize every variable in the SQL query, can I spare myself doing the validation with is_numeric(), etc.?

  2. What is the best way to create a injection detection system? Simply validate the user's input with regex stuff and save it in the database?

TRiG
  • 10,148
  • 7
  • 57
  • 107
Crayl
  • 1,883
  • 7
  • 27
  • 43
  • possible duplicate of [Are PDO prepared statements sufficient to prevent SQL injection?](http://stackoverflow.com/questions/134099/are-pdo-prepared-statements-sufficient-to-prevent-sql-injection) – Johan Jun 25 '11 at 20:28
  • 1
    possible duplicate of [How to prevent SQL injection in PHP?](http://stackoverflow.com/questions/60174/how-to-prevent-sql-injection-in-php) – Michael Berkowski Apr 01 '13 at 11:03

5 Answers5

4

Parametrizing your query is enough, you don't need anything else. You'll input the stuff they "inject" als a string, and there is nothing especially wrong with sql in a database... I suspect SO's database is full of SQL ;)

Nanne
  • 64,065
  • 16
  • 119
  • 163
3

Escaping a value for MySQL simply adds a backslash in front of of the following characters: NULL \n \r \ ' " and 0x1A. It does nothing else.

An "escaped" value isn't magically safe for use in SQL. Escaping prevents special characters (such as quotes) from being misinterpreted. But if you insert an escaped value into an SQL query without surrounding it in quotes, then you've completely missed the point, and you are no more safe than you would have otherwise been.

Remember, the security procedure is quote and escape. You should always use those two together, since neither is safe without the other.

Also, if you can absolutely guarantee that your input value contains none of the above characters, then you also can be certain that your escaped string will always be identical to the unescaped one, and therefore escaping serves no additional purpose under those conditions.

But More Importantly:

Finally we have, in retrospect, realized that SQL was poorly designed from a security perspective, and relying on users properly quote and escape their data is just a really bad idea.

Parameterized queries are the solution, since it safely separates the data from the control structure. Parameterized queries are possible with mysqli by using prepare() followed by bind_param(). No escaping is necessary when using this method, and you can be confident that you are absolutely immune from SQL injection attacks.

Community
  • 1
  • 1
tylerl
  • 30,197
  • 13
  • 80
  • 113
2

Even if you have protected your variables against injection by using a parameterized query or mysql_real_escape_string() (not mysql_escape_string()), you should still validate them on the server side to ensure that they match the expected type of input. That way, if they do not, you can return an error message to your user with a request to retry those form fields.

If you use a parameterized query, such as offered by MySQLi as prepared statements, you needn't also escape the strings. However, if you don't use a parameterized query, it is essential to call mysql_real_escape_string() on every input parameter received by PHP.

Michael Berkowski
  • 267,341
  • 46
  • 444
  • 390
1

This is a good question, and I think one of the best ways to avoid SQL injection is to learn about proper use of prepared statements

These will really help out the security of your application.

LainIwakura
  • 2,871
  • 2
  • 19
  • 22
0

The issue with sql injection is the user inserting SQL data into a command and not validating that the data meets your business rules.

Making sure all user data is passed through mysqli_real_escape_string or used prepared statements is the best way to avoid problems.

datasage
  • 19,153
  • 2
  • 48
  • 54