RE: [PHP] SQL security
From: Mike Migurski (mike_at_saturn5.com)
Date: 10/17/03
- Next message: John Black: "(ANNOUNCE) codeSECURE 1.0 released - - Protecting PHP code"
- Previous message: Chris W. Parker: "RE: [PHP] SQL security"
- In reply to: Chris W. Parker: "RE: [PHP] SQL security"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Fri, 17 Oct 2003 09:15:25 -0700 (PDT) To: "Chris W. Parker" <cparker@swatgear.com>
>> If you're using MySQL, you can use mysql_real_escape_string(). If
>> you're using another database, hopefully there is a similar function.
>
>Doesn't MySQL automatically protect against attacks like SQL injection?
>Or maybe it's that it automatically applies addslashes()? I can't
>remember exactly.
No - I don't think any database could automatically protect against SQL
injection, since the basis of that attack is the malformation of queries
before they even hit the DB. There is a magic quotes feature, which adds
slashes to request variable. You may be thinking of that:
<http://php.net/manual/en/ref.info.php#ini.magic-quotes-gpc>
---------------------------------------------------------------------
michal migurski- contact info and pgp key:
sf/ca http://mike.teczno.com/contact.html
- Next message: John Black: "(ANNOUNCE) codeSECURE 1.0 released - - Protecting PHP code"
- Previous message: Chris W. Parker: "RE: [PHP] SQL security"
- In reply to: Chris W. Parker: "RE: [PHP] SQL security"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
|
