CODEWITHSUNDEEP
security
Tai Kwangi Chicken
Tai Kwangi Chicken

Reputation: 623

Is Checking for String Quotes a Reliable Form of SQL Injection Preventing?

I would like to know if this is reliable. In my PHP file I do the following code:

if(strpos($text,"'") === false) {
    //perform query
} else { /*illegal character*/ }

I know I probably sound like an idiot, but what are the flaws in this? Can someone use different character encoding perhaps to get around it and inject a single quote?

Upvotes: 0

Views: 186

Answers (2)

elixenide
elixenide

Reputation: 44833

No, it's not. Injections can use ', ", ; and any number of other characters. For example, if you use the wrong text encoding, some Unicode characters can be used to terminate a string. As @TheShiftExchange points out, your code would let through a DROP TABLES command, and it could result in all sorts of other injections.

Upvotes: 0

Laurence
Laurence

Reputation: 60048

If you want to prevent SQL Injection - then follow the guidelines here: How can I prevent SQL injection in PHP?

Trying to implement your own custom measures is only going to end in tears.

And for the record - your code will not prevent SQL injections. For example 

105; DROP TABLE Suppliers

would get through

Upvotes: 2

Related Questions