mysql_real_escape_string HELP!!

[CreativityKills]

Well i dont think there is more to add, Gumslone already said it all. Most developers on here confuse mysql_real_escape_string and htmlspecialchars. Ive seen a lot of times where some apps here pass data to the database using the htmlspecialchars function. Thats wrong. mysql_real_escape_string and proper coding practice can handle injection just fine. htmlspecialchars should be used ONLY to escape special characters that might be stored in the DB harmlessly but could come out to be potential XSS attacks. For instance someone posted in a forum:

<b>This is an injected html code.

When fetching from the database, it would save u alot of heartache if you just escape with htmlspecialchars that way the browser doesnt interprete the < b > as html tags but as string. Thats where that function comes into play, not for sql query escaping.

[GumSlone]

@metulj - mysql_real_escape_string() cannot stand alone. . . Like what you did. . htmlspecialchars and striptags was added which is better.

of cause it can stand alone,
striptags and html special chars is another story, and we talk here about prevention of mysql injection, so mysql_real_escape_string will do the job.

[analyzer]

@metulj - mysql_real_escape_string() cannot stand alone. . . Like what you did. . htmlspecialchars and striptags was added which is better.

[icedroplet1987]

if you do it the same way like in my examples everything will be ok.

ok but i did as methulj mentioned.. covered all requests.. so its safe . right?

have a look on methulj code sir.

[GumSlone]

i did as the last method.. same which methulj told.. willl it be ok?

if you do it the same way like in my examples everything will be ok.

[icedroplet1987]

you have to do it like in my example

$q = mysql_query("select from users where username = '".mysql_real_escape_string($_GET['username'])."' "); 

or

mysql_query("UPDATE users SET age='".intval($_REQUEST['age'])."', user_infos='".mysql_real_escape_string($_REQUEST['user_infos'])."', user_location='".mysql_real_escape_string($_REQUEST['location'])."' WHERE username = '".mysql_real_escape_string($username)."' "); 

or

$age = intval($_REQUEST['age']);
$user_infos = mysql_real_escape_string($_REQUEST['user_infos']);
$location = mysql_real_escape_string($_REQUEST['location']);
$username = mysql_real_escape_string($username);
mysql_query("UPDATE users SET age='".$age."', user_infos='".$user_infos."', user_location='".$location."' WHERE username = '".$username."' "); 

i did as the last method.. same which methulj told.. willl it be ok?

[GumSlone]

you mean to say that i have to use it in each single mysql call too????

i am already tired of implementing it with get, post etc..

do i have to do in sql queries too?

you have to do it like in my example

$q = mysql_query("select from users where username = '".mysql_real_escape_string($_GET['username'])."' "); 

or

mysql_query("UPDATE users SET age='".intval($_REQUEST['age'])."', user_infos='".mysql_real_escape_string($_REQUEST['user_infos'])."', user_location='".mysql_real_escape_string($_REQUEST['location'])."' WHERE username = '".mysql_real_escape_string($username)."' "); 

or

$age = intval($_REQUEST['age']);
$user_infos = mysql_real_escape_string($_REQUEST['user_infos']);
$location = mysql_real_escape_string($_REQUEST['location']);
$username = mysql_real_escape_string($username);
mysql_query("UPDATE users SET age='".$age."', user_infos='".$user_infos."', user_location='".$location."' WHERE username = '".$username."' "); 

[icedroplet1987]

if you put everything into single quotes and mysql_real_escape string then there cant be done much wrong.
like

$sql = "select from users where username = '".mysql_real_escape_string($username)."' "; 

same with inserts and updates

or use intval() for integer values

$sql = "select from users where id = '".intval($id)."' "; 

you mean to say that i have to use it in each single mysql call too????

i am already tired of implementing it with get, post etc..

do i have to do in sql queries too?

[GumSlone]

if you put everything into single quotes and mysql_real_escape string then there cant be done much wrong.
like

$sql = "select from users where username = '".mysql_real_escape_string($username)."' "; 

same with inserts and updates

or use intval() for integer values

$sql = "select from users where id = '".intval($id)."' "; 

[icedroplet1987]

si, is it not safe what methulj is using ha?

[StunningNick]

Hey friends, i will like to know if i parse all data thru

mysql_real_escape_string

then will it protect my site from sql injection?? and its dark-sides?? any harm using it??

likewise this for all get , post, server etc

$msg = mysql_real_escape_string( $_GET['msg'] );

please leave your valuable comments @ all

you may find this link helpful

note : below link contains useful info + free some kinda malware so beware :P
http://www.itshacked.com/350/bypassi...-possible.html

Exploiting hard filtered SQL Injections

also if you don't provide proper charset type, mysql_real_escape_string can't help you, cause default charset is set to UTF-8 according to php bugs report it is fixed way back in 2006 but i still found it working on some sites but not all .

[shushant]

but as i said, i saw site with sessions arent hidden n even not destroying (endless) n perfectly secured thats why i asked so.. if you know you or anybody else on this forum knows it then please share the information on this or codes too.

Added after 10 minutes:



and bro, should i parse even $_session , $_server from it.. // i mean all requests??

function clean($do = null){
return isset($do) ? mysql_real_escape_string(strip_tags(htmlspecialchars(trim($do)))) : null;
}

useage

echo clean($_POST['var']);//For Post
echo clean($_GET['var']);//FOR get
echo clean($_SERVER['var']);//FOR server

[icedroplet1987]

but as i said, i saw site with sessions arent hidden n even not destroying (endless) n perfectly secured thats why i asked so.. if you know you or anybody else on this forum knows it then please share the information on this or codes too.

Added after 10 minutes:

i dont see why that wouldnt be enough...?? you mind to explain ?

other than that... i do prefer this

$msg = mysql_real_escape_string(strip_tags(htmlspecialchars($_GET['msg']))); 

just to ''sleep better''

and bro, should i parse even $_session , $_server from it.. // i mean all requests??

[metulj]

thnx methulj brother.. please also tell, anything wrong in using this?? as i am sure it will protect injection but any harm of it??

other question, i can i make sessions do not expire.. means if user switch off broser n then switch on then also he should be logged in .. just like vbulletin remember me option.. i saw a lavalair site with sessions showing n secured too.. how is it possible n his sessions doesnt expire untill you logout or remove chache.. please enlight this question too @ all..

i wouldnt use ednless session...
if browser and/or IP has been changed,
i believe it is correct that session is ended
i might be wrong, but i think that way session is also a bit more secured

[icedroplet1987]

thnx methulj brother.. please also tell, anything wrong in using this?? as i am sure it will protect injection but any harm of it??

other question, i can i make sessions do not expire.. means if user switch off broser n then switch on then also he should be logged in .. just like vbulletin remember me option.. i saw a lavalair site with sessions showing n secured too.. how is it possible n his sessions doesnt expire untill you logout or remove chache.. please enlight this question too @ all..