Anti-MySQL Injection function

[wap-lord]

Does this protect you site for the injector.

[rayjee]

tnx men,....

[ksg91]

mysql_real_string_escape() can be used to remove sql queries.
e.g.

$x=mysql_real_string_escape($x);; 

[CreativityKills]

Lol yal stil on dis topic? LMAO.

[Anthony]

Thanks Nice Share

[riderz]

SQL Injection is security failure of the most hacked sites...

Here is Anti-MySQL Injection function:

function anti_injection($sql) {
   // removes words that contain sql syntax
   $sql = preg_replace(sql_regcase("/(from|select|insert|delete|where|drop table|show tables|#|\*|--|\\\\)/"),"",$sql);
   $sql = trim($sql); // strip whitespace
   $sql = strip_tags($sql); // strip HTML and PHP tags
   $sql = addslashes($sql); // quote string with slashes
   return $sql;
}

How to call the function:

<?php
$query = anti_injection($query);
?>

... or when you "post" the data:

<?php
$query = anti_injection($_POST['something']);
?>

or another one i found

if the topic was [HOW TO] Anti-SQL Injection Function I might have said that it did not depend on any given db, and there is a use for that, especially if you have SQL compliant functions for flat file, that said lets see what we can do to produce an anti-injection function the allows posting of (legal) SQL code in posts, and works irrelevant of SQL interface..

.. after a bit of research I have the following, which covers all eventualities

<?php

function anti_injection($sql,$debug=false) {
  if($sql=='') return;

  $single = false;   # do single quotes translation
  $double = false;   # do double quotes translation

//  $sql = trim($sql); # strip whitespace *(what if the first line is space indented? ie ascii art)
//  if (get_magic_quotes_gpc()) $sql = stripslashes($sql); # if you have problems with slashes
  $sql = htmlspecialchars($sql); # for < and >, &, single and double quote characters

  if(substr_count($sql,"'")==0) $single = false; else $single = true;
  if(substr_count($sql,'"')==0) $double = false; else $double = true;

  if($single) $sql = str_replace("'", '& #039;', $sql);  # for single quote characters
  if($double) $sql = str_replace('"', '&quote;', $sql); # for dpuble quote characters

  return $sql;
}


?>

the echo's are just for testing (eg: $safe_sql = anti_injection($data_to_be_sanitized,true);) , as these may be set differently on your PHP installation (not 110mb)

(NOTE: when copying either of these PHP quoted code functions, change "& #039;" to read "'" - minus space, its a quirk of the PHP code hiliter, it outputs "'" as "'")

that said, for pure speed I would use the following (less the comments)

<?php
function anti_injection($sql) {
  $sql = htmlspecialchars($sql); # for < and >, &, single and double quote characters
  $sql = str_replace("'", '& #039;', $sql);  # for single quote characters (just in case)
  $sql = str_replace('"', '&quote;', $sql); # for dpuble quote characters (just in case)

  return $sql;
}
?>

or as antimatter might prefer

function sql_ai($sql){return str_replace('"','&quote;',str_replace("'", ''',htmlspecialchars($sql)));}