Preventing SQL injection in PHP with MDB2

Question

I'm trying to figure out how to prevent sqlinjection, I wrote this basic function : function

antiInjectie($inputfromform){
    $temp = str_replace("'", "`",$inputfromform);
    $temp = str_replace("--", "~~",$temp);
    return htmlentitites($temp);
}

However someone told me to also take hex values in consideration, but how do I do this?

Update I'm stuck with MDB2 and pgsql

http://stackoverflow.com/questions/60174/best-way-to-stop-sql-injection-in-php — Jacob, Jul 17 '11 at 17:30
If you aren't going to use PDO, look at the DB functions of the connection type you are using. They usually have escape functions already wrapped. — afuzzyllama, Jul 17 '11 at 17:34

score 6 · Accepted Answer · edited Dec 16 '17 at 05:14

6

Bobby-Tables has a good guide to preventing SQL injection.

In short: Don't twiddle with the input yourself, use database API methods that allow bound parameters.

edited Dec 16 '17 at 05:14

Cœur

37,241
25
195
267

answered Jul 17 '11 at 17:31

Quentin

914,110
126
1,211
1,335

1

Bobby tables is not a "great link." – Darth Egregious Dec 17 '15 at 14:57
Engaging example showing why the problem is a problem? Check. Explanations of how to deal with the problem in a variety of languages? Check. Invitation to supply improvements or report issues? Check. Seems pretty great here. – Quentin Dec 17 '15 at 14:59

score 2 · Answer 2 · edited May 23 '17 at 12:32

2

With MDB2 you can do the same as with PHP’s native PDO abstraction that was proposed in related question Best way to stop SQL Injection in PHP. You can either use a prepared statement with prepare and execute or by quoting and inserting the values manually.

edited May 23 '17 at 12:32

Community

1
1

answered Jul 17 '11 at 17:48

Gumbo

643,351
109
780
844

score 2 · Answer 3 · answered Jul 17 '11 at 19:57

2

Use pg_query_params(), the most easy function to avoid SQL injection using PHP and PostgreSQL.

answered Jul 17 '11 at 19:57

Frank Heikens

117,544
24
142
135

score 1 · Answer 4 · answered Jul 17 '11 at 17:33

First, don't write any escapting function yourself. They're very likely to be broken and the database library is very likely to contain a proper one. For mysql you can use mysql_real_escape_string.

A much better longterm solution though is not to create your full query as text, but rather use prepared queries and pass the values during execution. For mysql, check the mysqli extension.

Preventing SQL injection in PHP with MDB2

4 Answers4

Linked