Skip to main content
GameDev.net gamedev.net
🔒 Locked

Question with PHP accessing mysql

Started by yewbie Oct 25, 2012 at 3:05 PM 5 replies 1.4k views
Original Post
yewbie
yewbie
I have a custom web application I am playing around with written in php accessing a mysql database using a html interface.
Let me qualify this and say that I am very new to PHP and I may be unaware of something considered standard.

I am calling functions from inside my php (webpage) file that the user accesses with 2 or more variables like:

function TestFunctionRpt($orderby,$sort)

I sanitize both of my input variables using the PHP function "mysql_real_escape_string()".
http://php.net/manual/en/function.mysql-real-escape-string.php

Now my question is this, this seems very very simple am I actually protecting myself from SQL injection?
Is there anything else I need to look out for?

Also for reference my function is called like this inside my page.

[source lang="php"]TestFunctionRpt($_GET ['orderby'],$_GET ['sort'],$_GET['cust'],$_GET['startdate'],$_GET['enddate']);?>
[/source]

Thank you for reading, hopefully you are having a great day!
Washu
Washu
Use parameterized queries. Don't just concatenate strings together to make your SQL statements.
In time the project grows, the ignorance of its devs it shows, with many a convoluted function, it plunges into deep compunction, the price of failure is high, Washu's mirth is nigh.
yewbie
yewbie

Use parameterized queries. Don't just concatenate strings together to make your SQL statements.


Here is what I am currently doing, does this count as a parameterized query?

[source lang="php"]BlahRpt($orderby,$startdate,$enddate)
{
$sanorderby = $this->SanitizeForSQL($orderby);
$sanstartdate = $this->SanitizeForSQL($startdate);
$sanenddate = $this->SanitizeForSQL($enddate);

$qry = "Select * from $this->tablename WHERE RequiredDate >= '$sanstartdate' AND RequiredDate <= '$sanenddate' ORDER BY $sanorderby ASC";
}
[/source]


[source lang="php"]function SanitizeForSQL($str)
{
if( function_exists( "mysql_real_escape_string" ) )
{
$ret_str = mysql_real_escape_string( $str );
}
else
{
$ret_str = addslashes( $str );
}
return $ret_str;
}[/source]
Washu
Washu
No, that's string concatenation at its best/worst.

http://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php
In time the project grows, the ignorance of its devs it shows, with many a convoluted function, it plunges into deep compunction, the price of failure is high, Washu's mirth is nigh.
yewbie
yewbie
Thank you very very much, that link was very informative.

So Bind, Prepare, Execute. Seems easy enough.
And feel free to not answer this if its a long response (as I am trying to google the answer after I post this).

My guess would be even though I am removing escape sequences there are ways around that through injection?

Also I have found a great deal of information on the php page about why using mysql_real_escape_string is bad. http://php.net/manual/en/function.mysql-real-escape-string.php

Thank you for your time Washu =)
SimonForsman
SimonForsman

My guess would be even though I am removing escape sequences there are ways around that through injection?


No, there shouldn't be unless there is a bug in PHPs mysql library or you are using multiple sql connections with different char-sets (in which case you have to pass the connection to the escape function aswell), but it is still a good idea to always use parameterized queries because they are virtually impossible to mess up with. (PHP will not complain if you forget/miss escaping a value, you will get an error if you don't use parameterized queries correctly)
[size="1"]I don't suffer from insanity, I'm enjoying every minute of it.
The voices in my head may not be real, but they have some good ideas!
yewbie
yewbie
Awesome, thanks Simon!

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.

Sign in to reply to this topic.