Anti-MySQL Injection function

[BioBeo]

Man.. No Need to Update each and every single POST or GET method

All you can do this and Prevent Injecting via .htcaccess there you can add the queary string as :


union|select|insert|cast|set|declare|drop|update|m d5|benchmark

[something else]

Man.. No Need to Update each and every single POST or GET method

All you can do this and Prevent Injecting via .htcaccess there you can add the queary string as :


union|select|insert|cast|set|declare|drop|update|m d5|benchmark

if(isset($_REQUEST)){foreach($_REQUEST as $key=>$value){$_REQUEST[$key]=mysql_real_escape_string(htmlspecialchars($value));}} 

[marduck]

try it

function anti_sql_injection( $input ) {
// daftarkan perintah-perintah SQL yang tidak boleh ada
// dalam query dimana SQL Injection mungkin dilakukan
$aforbidden = array (
"insert", "select", "update", "delete", "truncate",
"replace", "drop", "or", ";", "#", "–", "=" );

// lakukan cek, input tidak mengandung perintah yang tidak boleh
$breturn=true;
foreach($aforbidden as $cforbidden) {
if(strripos($input, $cforbidden)) {
$breturn=false;
break;
}
}
return $breturn;
}

[subzero]

i updated mine try that one and see if anyone can add there self owners lol

[rayjee]

SQL Injection is security failure of the most hacked sites...

Here is Anti-MySQL Injection function:

function anti_injection($sql) {
   // removes words that contain sql syntax
   $sql = preg_replace(sql_regcase("/(from|select|insert|delete|where|drop table|show tables|#|\*|--|\\\\)/"),"",$sql);
   $sql = trim($sql); // strip whitespace
   $sql = strip_tags($sql); // strip HTML and PHP tags
   $sql = addslashes($sql); // quote string with slashes
   return $sql;
}

How to call the function:

<?php
$query = anti_injection($query);
?>

... or when you "post" the data:

<?php
$query = anti_injection($_POST['something']);
?>

or another one i found

if the topic was [HOW TO] Anti-SQL Injection Function I might have said that it did not depend on any given db, and there is a use for that, especially if you have SQL compliant functions for flat file, that said lets see what we can do to produce an anti-injection function the allows posting of (legal) SQL code in posts, and works irrelevant of SQL interface..

.. after a bit of research I have the following, which covers all eventualities

<?php

function anti_injection($sql,$debug=false) {
  if($sql=='') return;

  $single = false;   # do single quotes translation
  $double = false;   # do double quotes translation

//  $sql = trim($sql); # strip whitespace *(what if the first line is space indented? ie ascii art)
//  if (get_magic_quotes_gpc()) $sql = stripslashes($sql); # if you have problems with slashes
  $sql = htmlspecialchars($sql); # for < and >, &, single and double quote characters

  if(substr_count($sql,"'")==0) $single = false; else $single = true;
  if(substr_count($sql,'"')==0) $double = false; else $double = true;

  if($single) $sql = str_replace("'", '& #039;', $sql);  # for single quote characters
  if($double) $sql = str_replace('"', '&quote;', $sql); # for dpuble quote characters

  return $sql;
}


?>

the echo's are just for testing (eg: $safe_sql = anti_injection($data_to_be_sanitized,true);) , as these may be set differently on your PHP installation (not 110mb)

(NOTE: when copying either of these PHP quoted code functions, change "& #039;" to read "'" - minus space, its a quirk of the PHP code hiliter, it outputs "'" as "'")

that said, for pure speed I would use the following (less the comments)

<?php
function anti_injection($sql) {
  $sql = htmlspecialchars($sql); # for < and >, &, single and double quote characters
  $sql = str_replace("'", '& #039;', $sql);  # for single quote characters (just in case)
  $sql = str_replace('"', '&quote;', $sql); # for dpuble quote characters (just in case)

  return $sql;
}
?>

or as antimatter might prefer

function sql_ai($sql){return str_replace('"','&quote;',str_replace("'", ''',htmlspecialchars($sql)));}

wer i guna put dis code? In the core?

[something else]

yeah put them in core well you can put them on other places but better off in core so they are available on every page