Filtering SQL Injections.

[Merijn]

Ohai,
Cuz some people have problems with SQL Injections. I have something that filters all the $_GET and $_POST.

Here u go:

foreach($_GET as $key => $value)
  {
    $_GET[$key]= addslashes_mssql($value);
  }
  foreach($_POST as $key => $value)
  {
    $_POST[$key]= addslashes_mssql($value);
  }

Put it in a global page, or something that every page include.

Cya.

 

[mutter]

Gunz use MS-SQL, no MYSQL.

 

[Merijn]

Gunz use MS-SQL, no MYSQL.

Editted,
Thanks.

 

[Vusion]

How about mysql_real_escape(don't remember the exact function's name. And for whoever is gay enough to say "mysql, I'll say, it's a goddamn filter function)

 

[SecretsOThePast]

How about mysql_real_escape(don't remember the exact function's name. And for whoever is gay enough to say "mysql, I'll say, it's a goddamn filter function)

Because real_escape is a mysql function. Add slashes is similar to that.

 

[Dave]

mysql_real_escape_string only works if there's a MySQL connection to a database.

A MySQL connection is required before using mysql_real_escape_string() otherwise an error of level E_WARNING is generated, and FALSE is returned. If link_identifier isn't defined, the last MySQL connection is used.

And what does the function addslashes_mssql do? Is it the same as addslashes? I never heard of that function and can't find it at php.net either.

If it's the same as the normal addslashes, then it can be bypassed.

To view the content, you need to sign in or register

 

[Lifeles5]

$query = "Update Account SET Name = ? WHERE UserID = ?";
$params = array('"DROP TABLE Login', "Test");
sqlsrv_query($query, $params);

$query = "Update Account SET Name = ? WHERE UserID = ?";
$params = array("'DROP TABLE Login", "Test");
sqlsrv_query($query, $params);

 

[Vusion]

mysql_real_escape_string only works if there's a MySQL connection to a database.


And what does the function addslashes_mssql do? Is it the same as addslashes? I never heard of that function and can't find it at php.net either.

If it's the same as the normal addslashes, then it can be bypassed.

To view the content, you need to sign in or register

I thought so, until fucking Cosmos told me it's just a filter, my bad.

 

[CheckPoint]

I thought so, until fucking Cosmos told me it's just a filter, my bad.

Meh, had to do with the fact that I was porting the SQL class I was using for my site(Originally it was using MySQL, now MSSQL, used to be for 2 different games altogether). Anyway, it is your fault for quoting me without verifying, so shut your mouth.

 

[Zunai]

Why should you use

foreach($_GET as $key => $value)
{
$_GET[$key]= addslashes_mssql($value);
}
foreach($_POST as $key => $value)
{
$_POST[$key]= addslashes_mssql($value);
}

Make a function? and use more then only addslashes -_-!