Re: SQL injection - mysql_real_escape_string()?

Will check it out, but for example, one of the first things I do is when 
making use of something like a row Id passed as a querystring/$_GET item, is 
use the is_numeric() function to make sure it's only a number, etc.

Stay well

Jacob Kruger
Blind Biker
Skype: BlindZA
'...fate had broken his body, but not his spirit...'

----- Original Message ----- 
From: "Jean Rafael Tardem Delefrati" <[email protected]>
To: <[email protected]>
Sent: Wednesday, February 15, 2012 10:00 PM
Subject: RES: [PHP-WIN] SQL injection - mysql_real_escape_string()?


> Hi,
>
> If you are specially paranoid, you can use prepared statements (only
> mysqli).
> If you are even more paranoid, you can use views and stored procedures and
> never let the user access (directly) the tables of your database.
>
> Never forget that $_GET functions can carry injections when you make some
> queries like "SELECT [...] WHERE id='" . $_GET["id"] . "'".
> You can even change from the default $_GET and $_POST to another function
> where you can check every input.
>
> There are a lot of things that can be done, so, I suggest you to read 
> this:
> The Ten Most Critical Web Application Security Risks -
> http://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-%202010.pdf
>
>
> Best regards,
> Jean Rafael Tardem Delefrati
>
> -----Mensagem original-----
> De: Jacob Kruger [mailto:[email protected]]
> Enviada em: quarta-feira, 15 de fevereiro de 2012 11:56
> Para: [email protected]
> Assunto: Re: [PHP-WIN] SQL injection - mysql_real_escape_string()?
>
> Ok, while did find some tutorial material on mysqli, etc., neither my wamp
> installation, or my online hosting server seem to support it at all, but
> anyway.
>
> Stay well
>
> Jacob Kruger
> Blind Biker
> Skype: BlindZA
> '...fate had broken his body, but not his spirit...'
>
> ----- Original Message -----
> From: "Jacob Kruger" <[email protected]>
> To: <[email protected]>
> Sent: Monday, February 13, 2012 7:38 AM
> Subject: [PHP-WIN] SQL injection - mysql_real_escape_string()?
>
>
> Just wondering if anyone else specifically does more than using
> mysql_real_escape_string function to check freely entered text values 
> before
>
> processing queries to a mysql database as such?
>
> Stay well
>
> Jacob Kruger
> Blind Biker
> Skype: BlindZA
> '...fate had broken his body, but not his spirit...'
>
>
> -- 
> PHP Windows Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
>
> -- 
> PHP Windows Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
> 


-- 
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php