sql injection / Browser-Hijacker prevention php

Question

Hi Folks,

I have a website where I can't use html_entities() or html_specialchars() to process user input data. Instead, I added a custom function, which in the end is a function, which uses an array $forbidden to clean the input string of all unwanted characters. At the moment I have '<', '>', "'" as unwanted characters because of sql-injection/browser hijacking. My site is encoded in utf-8 - do I have to add more characters to that array, i.e. the characters '<', encoded in other charsets?

Thanks for any help,

Maenny

Answer 1

You should escape ", too. It is much more harm than ', because you often enclose HTML attributes in ". But, why don't you simlpy use htmlspecialchars to do that job?

Futhermore: It isn't good to use one escaping function for both SQL and HTML. HTML needs escaping of tags, whereas SQL does not. So it would be best, if you used htmlspecialchars for HTML output and PDO::quote (or mysql_real_escape_string or whatever you are using) for SQL queries.

But I know (from my own experience) that escaping all user input in SQL queries may be really annoying and sometimes I simply don't escape parts, because I think they are "secure". But I am sure I'm not always right, about assuming that. So, in the end I wanted to ensure that I really escape all variables used in an SQL query and therefore have written a little class to do this easily: http://github.com/nikic/DB Maybe you want to use something similar, too.

Answer 2

1. htmlentities nor htmlspecialchars functions has nothing to do with sql injection
2. to prevent injection, you have to follow some rules, I've described them all here
3. to filter HTML you may use htmlspecialchars() function, it will harm none of your cyrillic characters

Answer 3

Put this code into your header page. It can prevent SQL injection attack in PHP.

function clean_header($string) { $string = trim($string);

// From RFC 822: “The field-body may be composed of any ASCII // characters, except CR or LF.” if (strpos($string, “\n“) !== false) { $string = substr($string, 0, strpos($string, “\n“)); } if (strpos($string, “\r“) !== false) { $string = substr($string, 0, strpos($string, “\r“)); }

return $string; }