restrict the scope of variables in a mysql query? with brackets?

Question

I can't remember what the method is meant to be for ensuring the scope of a variable in a query is restricted to prevent mysql injection.

where should i put brackets in the following examples?

UPDATE table SET col_1 = '$var', col_2 = '$var2' WHERE col_1 = '$var3'

and

SELECT * FROM table WHERE WHERE col_1 >= '$var1'

(Obviously looking for answers not using PDO!)

Answer 1

If you want to prevent SQL injection, use a prepared statement, the MySQL equivalent of a parameterized query.

Example:

$db_connection = new mysqli("myserver", "user", "pass", "db");
$statement = $db_connection->prepare("SELECT thing FROM stuff WHERE id = ?");
$statement->bind_param("i", $id);
$statement->execute();

And yes, that means do use PDO

Answer 2

Brackets have absolutely nothing to do with preventing SQL injections.

I could give you an answer using mysql_*() functions, but I won't.

If you want to be a programmer, you have to learn best practices. Saying "Obviously looking for answers not using PDO!" is ridiculous and you have a terrible attitude to go for the simple route.

Answer 3

Brackets have nothing to do with scope and scope has nothing to do with preventing SQL injection.

If you are restricted from using PDO and mysqli, you can prevent injection by escaping your data with mysql_real_escape_string:

$sql = "UPDATE table SET col_1 = '".mysql_real_escape_string($var)."'";

Answer 4

As far as scope affecting SQL injection, I think you're talking about the PHP register_globals, setting. Ensure it's off.

Register globals basically allows a user to create a global variable simply by passing in a parameter to a GET or POST. So, if you're using a global variable in your SQL access, and the user can guess your variable, they can inject code by setting the value.

Brackets have nothing to do with scope in PHP, however.

Take a look at the following to avoid SQL injection:

• Server side validation
• PHP filters
• SQL Escaping
• Parametrized Queries

You should be doing all four.