Printable View
well, since a friend of mine showed me a page he has "hacked" with sql injection, i realize how far people can get with it...
now i want to know how to prevent sql injecting on my site, like on login/register form what do i need, and is stripslashes() and -or strip_tags() required?
.. and maybe htmlspecialchars() in forms like guestbooks or forums, comments and so on?
i really want to make my sites secure, how can i prevent most sql injections?
I can't help with the code etc, as I haven't used PHP enough... but for most languages the way to solve it is to use Parameters for the data, so they can only be treated as data, and not part of the query itself.
For further explanation (including the other benefits), see the article Why should I use Parameters instead of putting values into my SQL string? from our Database Development FAQs/Tutorials (at the top of the Database Development forum).
none of the functions you mentioned help with SQL injection.
as si_the_geek said, using parameterized queries is the easiest and probably the best way to prevent SQL injection. this can be achieved in PHP by using the PDO or MySQLi extensions rather than the default MySQL extension. if you could choose, I would personally recommend PDO.
using these extensions may not be possible, however, and they are a lot different from using the MySQL extension. they are object based. if you don't want to switch or are uncomfortable with switching, then there is still hope for you. it's just not the best kind of hope.
I would suggest you read through this post that I made last year explaining in as much detail as possible how SQL injection actually works and how to prevent it using mysql_real_escape_string(), and also why magic_quotes_gpc() is an unreliable option.
ask questions (in this thread) if you need help or are confused.
well thanks si_the_geek and kows, i'll use mysql_real_escape_string then.
no questions yet, so i'll mark the thread as resolved.