4 ms·
mysql_real_escape_string isn't secure. AT ALL.
by thesis 13y ago
mysql_real_escape_string isn't secure. AT ALL.
- NegativeK 13y agoThis would be a perfect example of why SQL injections are so common: toolchains aren't secure (or even securish) by default -- and it isn't clear that this is the case.
- jordanthoms 13y agoAnyone not using prepared statements in 2013 is just being stupid - there is no reason to ever be vulnerable to a SQL injection, barring a bug in the database or driver you are using. It's totally unacceptable.
- dgroves 13y agoto be fair of the hundreds of comments I have read, you are the only person who has the correct advice for mitigating the risk of SQL injection. Everybody else should read the [OWASP SQL Injection cheat sheet](https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet https://www.owasp.org/index.php/SQL_Injection_Prevention_Che...) before giving advice. ;-)
- phoboslab 13y agoHow so? The function does what it's supposed to do. Of course you still have to write the rest of the SQL statement to make use of the escaped input - put all params in quotes (or much better: use prepared statements to begin with).
- alexjeffrey 13y agoit is when used correctly within quotes (and used with common charsets, but that's a different story altogether). There is no publicly known way to inject the following when the database is encoded in ISO-8859-1 or UTF-8: "SELECT ... WHERE `field_name` = '" . mysql_real_escape_string($string_value) . "'";