CODEWITHSUNDEEP
phpmysqlsql-injection
Lienau
Lienau

Reputation: 1353

PHP function to sanitize all data

Is it a good, or stupid idea to sanitize all the data that could be sqlinjected? I wrote a function that should do it, but I've never seen it done and was wondering if it was a poor idea. The function I wrote:

function sanitizeData()
{
    $_SERVER['HTTP_USER_AGENT'] = mysql_real_escape_string($_SERVER['HTTP_USER_AGENT']);
    foreach(array_keys($_COOKIE) as $key)
    {
          $_COOKIE[$key] = mysql_real_escape_string($_COOKIE[$key]);
    }
    foreach(array_keys($_POST) as $key)
    {
          $_POST[$key] = mysql_real_escape_string($_POST[$key]);
    }    
    foreach(array_keys($_GET) as $key)
    {
          $_GET[$key] = mysql_real_escape_string($_GET[$key]);
    }
}

Upvotes: 1

Views: 450

Answers (2)

Your Common Sense
Your Common Sense

Reputation: 157828

It is also very important to understand that mysql_real_escape_string do not sanitize anything.
By applying this function you do not make any data safe. That's very widespread misunderstanding.
This function merely escaping string delimiters. So, it works only for strings, quote delimited ones. Thus, real sanitization could be only like this: 

$_GET[$key] = "'".mysql_real_escape_string($_GET[$key])."'";

And even this one isn't suffice.

But as already Matt mentioned it would be very bad practice. And even more: as a matter of fact, not only input data should be properly formatted/paramertized. It's database function, not user input one! It has nothing to do with user input. Some data may come not from user input but from a file or other query or some service - it all should be properly formatted as well. That's very important to understand.

Also you are using an odd way to iterate arrays.
this one is more common:

foreach($_GET as $key => $value)
{
      $_GET[$key] = mysql_real_escape_string($value);
}

Upvotes: 0

Matthew Flaschen
Matthew Flaschen

Reputation: 284786

A bad idea; this is basically another version of the deprecated magic_quotes. Most of that data probably won't end up going into the database, so you'll end up escaping unnecessarily, and potentially double-escaping.

Instead, use prepared statements as needed. Look at mysqli_stmt (part of mysqli) and PDOStatement (part of PDO).

Upvotes: 6

Related Questions