I just found out because someone had a ' in their last name and it caused the script to not update anything after that. What's the best way to make their last name safe of any potental damaging characters?
views:
62answers:
3
A:
PHP has a function called mysql_real_escape_string, it should sanitize all the naughty characters.
SoosGjr
2010-04-05 00:47:25
I wanted to downvote, but you're not a full member yet :-) While the function does help (don't confuse it with mysql_escape_string, btw) it does not encourage good defensive programming -- forgetting it [once] or performing data manipulation after may lead to a very hard to find vulnerability.
pst
2010-04-05 02:51:10
@pst - Personally, I would question the other methods' universal superiority over sanitized variables. I find it a mere difference in coding style as long as it's implemented properly. However, I accept the fact that in a multi-developer environment, where it's required to play along with the others, prepared statements would be a more popular solution.
SoosGjr
2010-04-05 23:15:02
+2
A:
You should probably be using prepared statements if you're embedding the SQL to insert records into the DB in your logic. Among other things they will properly escape data values for you (as long as you use them consistently.)
T Duncan Smith
2010-04-05 00:53:03
Prepared statements are what M. Petrotta is referring to in his comment above. Here's a link to the documentation for them if you use the PDO abstraction layer for PHP: http://php.net/manual/en/pdo.prepared-statements.php In addition to escaping your data values prepared statements can be more efficient if you find yourself executing the same query repeatedly. If you're going to embed SQL directly in your code it's usually a good idea to use them.
T Duncan Smith
2010-04-05 01:18:09
@Doug The ones that don't allow SQL injection (or "break" when ' is inserted)
pst
2010-04-05 02:48:15
A:
You should use
print htmlentities("O'Brian",ENT_QUOTES);
before inserting into database, it will convert string to
O'Brian
so it is safe to store to database. Keep in mind that this function also escapes double quotes.
More info on escaping string.
Mike Arnold
2010-04-05 12:29:17