SQL Injection Qs

[Adrian Schneider]

How do you strip non alphanumeric characters from a string? I noticed people suggesting globalize() then setting each variables type to STR or INT, etc. Does the STR do that (I noticed it uses trim).

How does using trim compare with addslashes or the built-in mysql commands?

Thanks

[filburt1]

Have you read the relevant manual pages for trim() and addslashes()?

[Adrian Schneider]

Yes, read both of them.

PHP Code:

<?php

$input = "'a'";
$output = addslashes($input);

echo $output;
?>

Produces \'a\'

and

PHP Code:

<?php

$input = "'a'";
$output = trim($input);

echo $output;
?>

produces 'a'

How would I just show the a?

I think you would use stripslashes() when accessing the information with whatever query. I'm still learning too though.

[Marco van Herwaarden]

If you want to REMOVE all quotes, you would have to use a str_replace or preg_replace.

If you just want to create a version of your string that is safe to insert into a SQL, use addslashes to store, and if needed stripslashes later to retrieve the original string (vB does stripslashes automaitc in some cases).

[Revan]

Or use mysql_real_escape_string() instead of addslashes.
I am writing a script for my site which is not vB powered, and it automatically strips the slashes from the mysql_real_escape_string()'d result.

[Dean C]

Yep mysql_real_escape_string should be used instead of addslashes To strip non-alphanumeric characters you would use something like this:

PHP Code:

$string = preg_replace('/[^A-Za-z0-9]+/', '', $string); 


[Marco van Herwaarden]

I still have not found a good reason to prefer mysql_real_escape_string above the defacto standard in vB scripts addslashes.

[filburt1]

You should probably avoid using it as vB is designed (mostly) so that the database layer is below the application layer. Rephrased, it is not coded to be used just with MySQL through the use of the database wrapper class which can be modified to use any other supporting SQL-capable database.

It seems to escape more than quotes, but I thought it was only quotes that caused the problem. For example, it also escapes newlines for some reason. But, they wrote a full page on SQL injection at http://us4.php.net/manual/en/securit...-injection.php .

[Marco van Herwaarden]

Originally Posted by filburt1

You should probably avoid using it as vB is designed

You are talking about mysql_real_escape_string i suppose?