Just wrote this and thought I'd throw it up here, I know I'm not that active anymore but if I can help out in any way that's a plus .

 

http://thisismedia.co.uk/ben/2011/03/preventing-sql-injection-in-ph/

Just wrote this and thought I'd throw it up here, I know I'm not that active anymore but if I can help out in any way that's a plus .

 

http://thisismedia.co.uk/ben/2011/03/preventing-sql-injection-in-ph/

Very nice topic, but technally a simple function as below would prevent injections quite well

 

function clean_data($data){

global $mysqli;

return mysqli_real_escape_string(trim(htmlentities($data,ENT_QUOTES,'UTF-8')));

}

 

then use that on any data going into mysql

 

also filtering things that require int only to int only

 

$id = $_GET['id'];
$id = preg_replace('#[^0-9]#i', '', $id);

Edited March 28, 201115 yr by webdesigner93

Very nice topic, but technally a simple function as below would prevent injections quite well

 

function clean_data($data){

global $mysqli;

return mysqli_real_escape_string(trim(htmlentities($data,ENT_QUOTES,'UTF-8')));

}

 

then use that on any data going into mysql

 

also filtering things that require int only to int only

 

$id = $_GET['id'];
$id = preg_replace('#[^0-9]#i', '', $id);

 

I was going to write about casting to integers etc but I'm trying to keep it simple. Add it to the tutorial in the comments if you wish, might help someone using it .

I was going to write about casting to integers etc but I'm trying to keep it simple. Add it to the tutorial in the comments if you wish, might help someone using it .

I will deff do that u should write more blog post, i noticed u don't have many seems like a cool blog that i'd read if it had more post

I will deff do that u should write more blog post, i noticed u don't have many seems like a cool blog that i'd read if it had more post

 

Well at work we've been asked to blog a few times a week so the company appears more social. Should be able to keep a regular blog and get paid for the pleasure .

Just wrote this and thought I'd throw it up here, I know I'm not that active anymore but if I can help out in any way that's a plus .

 

http://thisismedia.co.uk/ben/2011/03/preventing-sql-injection-in-ph/

 

Well written article. However, just use PHP PDO. PDO binding does this for you and with pdo binding SQL injections are near on impossible.

Well written article. However, just use PHP PDO. PDO binding does this for you and with pdo binding SQL injections are near on impossible.

I think personally prepared statements are a lazy way of doing things, and can also get people out of the habit of filtering there data properly, not just for sql statements but for app security in general, plus mysql_real_escape_string does a good job of preventing most sql injects without the extra work of binding params ect..