I've coded one anti sql injection.

[LGPaul]

Hello RaGEZONE!

I've coded one anti sql injection, but i dont know if it will make me protected what do you guys think anyways?

function clean($value)
{
        $check = $value;
        $value = str_replace("'", "''", $value);
        
        if($check != $value)
        {
            $logf = fopen("secure/sqlattacks.log", "a+");
            fprintf($logf, "Date : %s IP : %s Code : %s, Fixed Code : %s\r\n", Date : date("d-m-Y h:i:s A"), IP : $_SERVER['REMOTE_ADDR'], $check, $value);
            fclose($logf);
            header("Location: index.php");
        }

        return($value);
}

All the best,
Paul.

 

[Secured]

Hello RaGEZONE!

I've coded one anti sql injection, but i dont know if it will make me protected what do you guys think anyways?

function clean($value)
{
        $check = $value;
        $value = str_replace("'", "''", $value);
        
        if($check != $value)
        {
            $logf = fopen("secure/sqlattacks.log", "a+");
            fprintf($logf, "Date : %s IP : %s Code : %s, Fixed Code : %s\r\n", Date : date("d-m-Y h:i:s A"), IP : $_SERVER['REMOTE_ADDR'], $check, $value);
            fclose($logf);
            header("Location: index.php");
        }

        return($value);
}

All the best,
Paul.

This wont protect against anything, use PHP: Prepared statements and stored procedures - Manual

 

[Ron]

If you want to half-ass it then at least use mysqli_real_escape_string().

 

[Solaire]

If you want to half-ass it then at least use mysqli_real_escape_string().

This is for MSSQL, not MySQL.

Anyway, you could encode the data as a hexadecimal, or go with the str_replace. Don't forget to call stripslashes() in case GPC is enabled and you might want to strip or escape HTML tags as well.

 

[Dave]

PDO_SQLSRV is indeed the best option for MSSQL.

PDO:repare

 

[Solaire]

PDO_SQLSRV is indeed the best option for MSSQL.

PDO:repare

You don't need to prepare the statement unless you're about to execute it more than once.

Something like this would do:

sqlsrv_query($pDBLink, "EXEC WZ_ACCOUNT_CREATE( (?), (?), (?), 0, 0, 0)", 
                array(
                    $_SERVER['REMOTE_ADDR'],
                    trim($_POST['email']),
                    trim($_POST['password'])
                )
            )

 

[LGPaul]

You don't need to prepare the statement unless you're about to execute it more than once.

Something like this would do:

sqlsrv_query($pDBLink, "EXEC WZ_ACCOUNT_CREATE( (?), (?), (?), 0, 0, 0)", 
                array(
                    $_SERVER['REMOTE_ADDR'],
                    trim($_POST['email']),
                    trim($_POST['password'])
                )
            )

function clean($value)
{
        $check = $value;
        $value = stripcslashes($value);
        $value = htmlspecialchars($value);  
        $value = trim($value);
        $value = strip_tags($value);
        $value = addslashes($value);
        $value = str_replace("'", "''", $value);
        
        if($check != $value)
        {
            $logf = fopen("secure/sqlattacks.log", "a+");
            fprintf($logf, "Date: %s IP: %s Code: %s, Fixed: %s\r\n", date("d-m-Y h:i:s A"), $_SERVER["HTTP_CF_CONNECTING_IP"], $check, $value);
            fclose($logf);
            alertbox("You tried to SQL Inject our website, the log has been sent to the Administrator.","index.php");
        }

        return($value);
}

this should do the work right?

 

[Ron]

This is for MSSQL, not MySQL.

OP needs to clarify next time.

 

[Solaire]

OP needs to clarify next time.

I agree.

function clean($value)
{
        $check = str_replace("'", "''", htmlentities(stripslashes($value));
        
        if($check != $value)
        {
            $logf = fopen("secure/sqlattacks.log", "a+");
            fprintf($logf, "Date: %s IP: %s Code: %s, Fixed: %s\r\n", date("d-m-Y h:i:s A"), $_SERVER["HTTP_CF_CONNECTING_IP"], $check, $value);
            fclose($logf);
            alertbox("You tried to SQL Inject our website, the log has been sent to the Administrator.","index.php");
        }

        return($value);
}

this should do the work right?

Also, remove the alertbox. If I register with username Solaire and password $34'sfa2a then that doesn't mean I'm SQL injecting, I just have a stupid password.