Re: [PHP] How to improve sql query security using php? From: Richard Creech (richardc <email protected>)
Date: 09/30/00

At 03:41 AM 9/30/00 -0700, Mike Glover of <mpg4 <email protected>> eloquently postulated:
<a very BIG snip was here>
>In short, what's
>stopping an attacker from running:
>
> http://your.page/script.php?userstable=secrettable&emailfield= code
>for *>
>
>to access your secret data? Best of luck.
>
>-mike

and Cary thus sayth:

"You should use substr or preg_replace to escape or get rid of
characters you know you don't want. The big ones you will want to
get rid of, or escape are of course \, _, %, " and ' (the
apostrophe). You can use addslashes to escape ", ' and \.

Cary
>_____________________________________

Ahhhh! Yes, this is what I need help with ... Thanks to Mike Glover of <mpg4 <email protected>> and also thanks to Cary Collett <cary <email protected>> for their kind and expeditious help.

So, if I use a specified name for the field, and a CONSTANT for the table name, and use quotemeta($myvar) individually on all the form field values to be passed to the sql select, and then used:

$query = verifyData($query);

where this function is declared:

function verifyData ($query) {
        if($query){
                $query = str_replace ("%", "", $query);
                $query = str_replace ("_", "", $query);
                /* quotemeta($str) is presumed to be used at the user form value
                // quotemeta() returns a backslash character (\) before every character
                // that is among these: . \\ + * ? [ ^ ] ( $ ) /*
                return $query;
        }else{
                exit;
        }
}

How could the combination of quotemeta() and verifyData() , or verifyData itself be improved for:

SELECT email, password FROM TABLENAME WHERE email ='$loginemail'

Or have we arrived at a secure state - I still don't see the fix for the original:
http://your.page/script.php?userstable=secrettable&emailfield= code
for *> ???

Richard Creech
http://dreamriver.com
richardc <email protected>
Phone 250.744.3350 Pacific Time 

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: php-general-unsubscribe <email protected>
For additional commands, e-mail: php-general-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>