SQL Injection Qs

[filburt1]

Yes, meaning I prefer addslashes(), although I didn't even know that MySQL function existed.

[Marco van Herwaarden]

So do i. I mean addslashes does the job, it is used everywhere else in vB code, and it is much easier to type.

[Adrian Schneider]

Just found all these replies.. lol

Thanks preg_replace was the main thing I was looking for.

[The Geek]

Why preg_replace?

I thought that a sql injection was when you did something like:

$myval=$_POST['myvalus'];
$results=$DB_site->query("SELECT * FROM bob WHERE frank='$myval'");

SInce there is no cleansing of $myval, people could take advantage of it by maybe creating a page that posted the $myval variable to be something like

PHP Code:

yea'; INSERT MALICIOUS CODE HERE 


SInce there is an apostraphe in there, your SQL command ends and people can append system commands after it.

Using addslashes escapes characters that would break the 'string' representation of the above so it would end up:

yea\'; INSERT MALICIOUS CODE HERE


Now they couldnt escape out of the string no matter how much system code was put in.

It was my understanding that globalize uses addslashes on STR's, intval on INTs (which turns the above into 0 as it isnt an integer) and it also addslashes AND converts HTML characters into codes when using STR_NOHTML.

Am I missing something?

[Marco van Herwaarden]

Nope you are not missing much, except that he clearly asked how to remove the quotes. I also don't know why he want that, but that was the question.

[Adrian Schneider]

Well I'm new to this stuff, but wouldn't preg_replace strip the ; as well as the ' making them unable to do that? Also (this may soon be irrelevant) how would I allow spaces from that statement? ( $string = preg_replace('/[^A-Za-z0-9]+/', '', $string); )

Which do you guys prefer for a text input? => STR or => STR_NOHTML?

[deathemperor]

STR_NOHTML and addslashes, because using preg_replace it will remove all non-alphabet char. I've tested it since my personal hack was having SQL injection with searching, I used preg_replace the search print out nothing but addslashes can.

btw, how many ways available to detect for SQL injection ?

[Marco van Herwaarden]

Originally Posted by deathemperor

btw, how many ways available to detect for SQL injection ?

2







Left eye and right eye.

[twoseven]

actually 3 i use brail