Re: sql injection php code for secure my page

Hey... Want to talk? Call me.... My telephone number >>>>

(+372) 56330687


Netman kirjutas Neljap=C3=A4ev, 5. veebruar 2015 kl 13:11:10 UTC+2:
> Hello again!=20
>=20
> I know that to prevent from sql injection I have to check the parameters=
=20
> getting i.e. from $_GET variable=20
>=20
> I have questions:=20
>=20
> 1) Could you provide me sensitive words on which I should stop running th=
e=20
> following/the next code?=20
> 2)=20
>=20
> I have written a function which check $_GET variable on such words as=20
> SELECT, DROP, DELETE, JAVASCRIPT,=20
> but it doesn`t work when the user sends a more than one dimensional array=
=20
> i.e. $_GET["action"][0] variable or $_GET["action"][0][0] etc=20
>=20
> so :=20
> a) http://www.domain.com/index.php?action=3Dabout-me=20
> my function doesn`t return any exception and the page is displayed=20
>=20
> and the following query is running and shows data:=20
> $sql=3D"SELECT * FROM table WHERE cat=3D'".$_GET["action"]."'";=20
>=20
> b) http://www.domain.com/index.php?action=3DJAVASCRIPT=20
> my function perfectly handles such exception and the page is not displaye=
d=20
>=20
> and the following query is not running:=20
> $sql=3D"SELECT * FROM table WHERE cat=3D'".$_GET["action"]."'";=20
>=20
> becasue the user sends JAVASCRIPT value for $_GET form variable.=20
>=20
> b) http://www.domain.com/index.php?action[0]=3DJAVASCRIPT=20
> my function doesn`t handle such exception and the page is displayed=20
>=20
> and the following query is running and but it doesn`t show any data:=20
> $sql=3D"SELECT * FROM table WHERE cat=3D'".$_GET["action"]."'";=20
> because=20
> $_GET["action"] variable is an array in this case=20
>=20
> Questions:=20
> 3) Do I have to create service in my parameter checking function when the=
=20
> $_GET is an array=20
> like this $_GET["action][0], $_GET["action"][0][0] etc....=20
> 4) Is it possible to run sql injection code when the quest is like this:=
=20
>=20
> $sql=3D"SELECT * FROM table WHERE cat=3D'".$_GET["action"]."'";=20
>=20
> and $_GET["action"] is an Array. Do I have to secure for such situation?=
=20
>=20
> Could you be so kind and answer my question?=20
>=20
> Kindest regards=20
> Marcin=20
>=20
>=20
> ---=20
> Ta wiadomo=C5=9B=C4=87 zosta=C5=82a sprawdzona na obecno=C5=9B=C4=87 wiru=
s=C3=B3w przez oprogramowanie antywirusowe Avast.=20
> http://www.avast.com