Search code examples
mysqlsqlsql-injectionmysql-real-escape-string

Which SQL inject methods aren't "destroyed" by mysql_real_escape_string();?

Is there a list of SQL injection methods which can't be protected with just using mysql_real_escape_string(); with utf8 encoding?

For integer, I'm using intval(); Is it secure enough?

For those who think I want to get "tutorial" to hack anyone: No, I won't. I just want to know how to make my applications more secure, and I want to know if they're secured 99% against hackers

Solution

  • If given a valid database connection, mysql_real_escape_string() is supposed to be safe for string data under all circumstances (with the rare exception described in this answer).

    However, anything outside a string, it won't escape:

    $id = mysql_real_escape_string($_GET["id"]);

mysql_query("SELECT * FROM table WHERE id = $id");

    is still vulnerable, because you don't have to "break out" of a string to add an evil additional command.