Comments on: Prevent SQL Injections with PHP

By: Kamlesh Chaube

Kamlesh Chaube — Fri, 19 Jun 2009 13:10:58 +0000

Great !!!
I like this help.
Thanks,

By: vonnero

vonnero — Wed, 15 Apr 2009 18:01:43 +0000

Great and direct to the point…. thanks

By: jesper

jesper — Wed, 11 Mar 2009 14:13:07 +0000

http://jesperkampmann.com/prevent-sql-injection.html

This website has a code there automatic escape all incomming data:
_POST, _SESSION, _COOKIE, _GET, _FILE

By: Amatoc Industries

Amatoc Industries — Tue, 16 Dec 2008 07:24:08 +0000

For making sure that something is an integer, you dont have to use the is_integer() function followed by an ugly OR DIE(). You can more simply just cast the input as an int using the following code:

$id = (int)$_GET['id'];

This casts the variable as one of type int. int variables cannot store any data other than ints. So… it is unable to store text. As such, malicious input such as 12′ OR 1=1 ‘ would just become 12.

I use this method myself to sanitize int inputs and it works like a charm

By: Android

Android — Thu, 13 Nov 2008 00:51:02 +0000

Super, just what I needed. One question: If mysql_real_escape_string() takes care of the problem why do the numeric and length checks?

By: Woolie

Woolie — Sun, 20 Apr 2008 22:41:42 +0000

Hi Roel, as the notice at the top of this post states, the code used in this post may be out of date. Please make sure you verify with other sources before using it.

To answer your question, no there is no real difference. The only thing I would note is that in the second one, to make the result exactly the same as the first, you may want to rewrite like so:

$result = mysql_query("SELECT* FROM animals WHERE name = $safe");

By: Roel

Roel — Sun, 20 Apr 2008 07:40:35 +0000

Is there a difference between:

$query = “SELECT * FROM animals WHERE name = $safe”;
$result = mysql_query( $query );

$query = mysql_query(”* FROM animals WHERE name = $safe”);

By: Nick

Nick — Wed, 25 Jul 2007 10:43:02 +0000

When you want to use a numeric value, you can just use this :

$id = (int)$_GET['id'];

By: johni

johni — Thu, 31 May 2007 15:12:09 +0000

Great article, i must say simply the best!

By: harry

harry — Tue, 15 May 2007 06:14:30 +0000

nice one dude