use it on the actual values in your query, not the whole query string itself.
example:
$username = mysql_real_escape_string($_POST['username']);
$query = "update table set username='$username' ...";
$rs = mysql_query($query);
mysql - How to use mysql_real_escape_string function in PHP - Stack Overflow
bypass "mysql_real_escape_string" - Security - Hak5 Forums
PDO - mysql_real_escape_string - PHP - SitePoint Forums | Web Development & Design Community
is mysql_real_escape_string enough?
use it on the actual values in your query, not the whole query string itself.
example:
$username = mysql_real_escape_string($_POST['username']);
$query = "update table set username='$username' ...";
$rs = mysql_query($query);
Rather than using the outdated mysql extension, switch to PDO. Prepared statement parameters aren't vulnerable to injection because they keep values separate from statements. Prepared statements and PDO have other advantages, including performance, ease of use and additional features. If you need a tutorial, try "Writing MySQL Scripts with PHP and PDO".
I'm still new to PHP and as part of my self education I'm hand-coding a CMS. So far all I've managed to make it do is dynamically pull page data. What content gets displayed depends on the value given in a $_GET variable. If one isn't present, it defaults to the homepage. That took a while to figure out...so many errors...
But anyway, I realized that since the GET ends up being part of my mysql query, I should probably secure it against SQL injection. My question is if running GET through mysql_real_escape_string() is enough to do that? Is there more I should/could be doing?
Or do I even need it in this specific case? This is how the $_GET is being used in my query-
$pull_page_data = mysql_query("SELECT * FROM pages WHERE page_id = '$page'");Can havoc still be caused at the end of the query?
But back to the primary question, is doing this enough to secure my database from a basic sql injection?
$page = mysql_real_escape_string($_GET['page']);
Thanks, guys!
The function adds an escape character, the backslash, \, before certain potentially dangerous characters in a string passed in to the function. The characters escaped are
\x00, \n, \r, \, ', " and \x1a.
This can help prevent SQL injection attacks which are often performed by using the ' character to append malicious code to an SQL query.
Say you want to save the string I'm a "foobar" in the database.
Your query will look something like INSERT INTO foos (text) VALUES ("$text").
With the $text variable replaced, this will look like this:
INSERT INTO foos (text) VALUES ("I'm a "foobar"")
Now, where exactly does the string end? You may know, an SQL parser doesn't. Not only will this simply break this query, it can also be abused to inject SQL commands you didn't intend.
mysql_real_escape_string makes sure such ambiguities do not occur by escaping characters which have special meaning to an SQL parser:
mysql_real_escape_string($text) => I\'m a \"foobar\"
This becomes:
INSERT INTO foos (text) VALUES ("I\'m a \"foobar\"")
This makes the statement unambiguous and safe. The \ signals that the following character is not to be taken by its special meaning as string terminator. There are a few such characters that mysql_real_escape_string takes care of.
Escaping is a pretty universal thing in programming languages BTW, all along the same lines. If you want to type the above sentence literally in PHP, you need to escape it as well for the same reasons:
$text = 'I\'m a "foobar"';
// or
$text = "I'm a \"foobar\"";
You should never use anything "to reduce the likelihood of SQL injections" in the first place. It just doesn't work this way. You are not adding some code just in case, sort of a rabbit foot. SQL injections simply must be prevented, using certain tools. It is so easy to achieve that it just should go without saying. Just never add any variable to your SQL queries - that's all. Here is how. It doesn't only prevent injections but also relieves you from that escaping mess.
That said, no extra slashes should appear in the output unless there is an error in your code. Escaping is used for the query only, it is not stored in the database. So instead of removing extra slashes you must not add them in the first place.
No, it's not safe, because what you are doing is wrong. In your code you are echoing a variable that has only been sanitized using mysqli_real_escape_string (https://www.php.net/manual/en/function.mysql-real-escape-string.php). All that function does is prepend backslashes to some characters, like the single quote, the new line character, etc. This function was only meant to sanitize a string before using it in an SQL statement. By the way, today it is considered bad practice to use such a function, and the recommended way to make queries to the database is to use prepared statements. It's a totally different way to make queries, and you will need to use another set of PHP functions and objects.
To echo something on an HTML web page you can't use mysqli_real_escape_string for sanitization, because the set of dangerous characters is different. In HTML, you need to escape the < and > characters, for example. Other characters might have to be escaped depending on where you are echoing them, for example the single or double quote. Also, the escaping method is different from the one used for SQL: a single quote in HTML won't be prepended with a backslash when escaped, but will need to be replaced with an HTML entity, becoming '. A PHP function you might use for this is htmlspecialchars (https://www.php.net/manual/en/function.htmlspecialchars.php).