3 ms·

Languages are like tools: buying a the best set you can afford is the best possible start to a project. PHP doesn't cause SQL injection flaws, but it doesn't ma

by hapless 17y ago

Languages are like tools: buying a the best set you can afford is the best possible start to a project. PHP doesn't cause SQL injection flaws, but it doesn't make it any easier. How many escape functions are there ? Shall we count them ? ---------- mysql_escape_string() - Escapes a string for use in a mysql_query mysql_real_escape_string() - Escapes special characters in a string for use in a SQL statement mysqli_real_escape_string() - Escapes special characters in a string for use in a SQL statement, taking into account the current charset of the connection addslashes() - Quote string with slashes stripslashes() - Un-quotes a quoted string The magic_quotes_gpc directive The magic_quotes_runtime directive stripcslashes() - Un-quote string quoted with addcslashes stripslashes() - Un-quotes a quoted string addcslashes() - Quote string with slashes in a C style htmlspecialchars() - Convert special characters to HTML entities quotemeta() - Quote meta characters get_magic_quotes_gpc() - Gets the current configuration setting of magic quotes gpc ---------------- I especially love the contrast between "mysql_escape_string" and "mysql_real_escape_string," since the first one is fake in a magical, side-effect-laden way.

EliAndrewC 17y ago
I think this comment sums it up nicely: http://blog.ianbicking.org/php-ghetto-comment-11.html http://blog.ianbicking.org/php-ghetto-comment-11.html It basically argues that in PHP there's often an easy, insecure way to do something and a verbose, secure way to do it. With regards to SQL injection, Java is the same way; prepared statements are much more verbose and annoying than string concatenation.
- rbanffy 17y ago
  I regard string concatenation as very annoying in Java. Actually, just about anything is annoying in Java. I guess I have been spoiled by more modern languages like... Smalltalk/80 or Lisp'56.
brianr 17y ago
I wouldn't be so hard on php for the mysql_* functions; they're wrappers around the C functions of the same names: http://dev.mysql.com/doc/refman/5.1/en/mysql-escape-string.html http://dev.mysql.com/doc/refman/5.1/en/mysql-escape-string.h...
- hapless 17y ago
  I wouldn't use C for web applications, either.
abyssknight 17y ago
They do exist, but I would never use any of them. I'd use a prepared statement. PHP has come a long way since stripslashes. It just isn't flavor of the month.

by hapless 17y ago

EliAndrewC 17y ago

I think this comment sums it up nicely: http://blog.ianbicking.org/php-ghetto-comment-11.html http://blog.ianbicking.org/php-ghetto-comment-11.html It basically argues that in PHP there's often an easy, insecure way to do something and a verbose, secure way to do it. With regards to SQL injection, Java is the same way; prepared statements are much more verbose and annoying than string concatenation.

rbanffy 17y ago
I regard string concatenation as very annoying in Java. Actually, just about anything is annoying in Java. I guess I have been spoiled by more modern languages like... Smalltalk/80 or Lisp'56.

brianr 17y ago

I wouldn't be so hard on php for the mysql_* functions; they're wrappers around the C functions of the same names: http://dev.mysql.com/doc/refman/5.1/en/mysql-escape-string.html http://dev.mysql.com/doc/refman/5.1/en/mysql-escape-string.h...

hapless 17y ago
I wouldn't use C for web applications, either.

abyssknight 17y ago

They do exist, but I would never use any of them. I'd use a prepared statement. PHP has come a long way since stripslashes. It just isn't flavor of the month.