CODEWITHSUNDEEP
phpsecurity
Sam Khan
Sam Khan

Reputation: 2477

Will this SQL injection prevention work in theory?

I plan to prevent SQL injections by using the the $variable and route it to a function that will scan the $variable for any sql commands or any attempts of injections. I will also make a list of common sql commands that people would use inject so it would be detected.

Note: I previously asked a similar question but this time I have a theory I managed to think ;)

Upvotes: 1

Views: 81

Answers (2)

Quentin
Quentin

Reputation: 943220

No. Blacklisting will inevitably give false positives and almost certainly give false negatives.

Use bound parameters and let the database deal with it for you.

Upvotes: 3

ant7
ant7

Reputation: 421

The simplest and secure way to prevent SQL injection is to use mysql_real_escape_string() on any untrusted data (eg: $_GET or $_POST). It will escape any special characters so the query will be safe.

If you use mysqli, see http://www.php.net/manual/en/mysqli.real-escape-string.php

More about SQL injection and how can you protect yourself against it: http://www.php.net/manual/en/security.database.sql-injection.php

So, your plan it's not the best way to do it. It unnecessarly complicates things.

Upvotes: 3

Related Questions