Tag Archives: php

Why mysql_real_escape_string() isn’t enough to stop SQL injection attacks!

We have all been there writing PHP code and trusting mysql_real_escape_string(). Alas it seems it is not enough, let us look at the example below ;

As you can see above simply using mysql_real_escape_string is not enough because the new output is in the end “0; Delete from users”.

However don’t fret dear reader because there is a solution! Make sure the $id is indeed only a number! This can be done by simply using the code below;

This way any string elements will simply won’t be added the system. Now a question may arise on how to make sure you don’t get injected with attack if the parameter is in fact a string. My answer is simply : USE THE FRICKEN SQL QUOTES! Like below;

The quotes will allow some protection.
I hope this helps you all! And please don’t tell newbies that mysql_real_escape_string() is enough! IT IS NOT!

From the beginning please

Hi there. Summer over and so is my work with the company RENKO ITH.  IHR. LTD. STI.. Worked for peanuts doing lots. Proud of it. Paid my school tuition with the peanuts. I think this makes my school a three ring circus :D.

Work was good and honest in RENKO. I wore three hats at all times ;

Continue reading