http://us.php.net/mysql_real_escape_string
and scroll down to "Example #3 A "Best Practice" query", it's not really a BEST BEST practice but it's good enough.
A tip, to instantly secure half of your input, just intval() all integers. That will solve half your problems. You don't have to escape them any other way.
This is probably better to use on your input instead of the clutter of the conditional statement with "if(get_magic_quotes_gpc())":
function SmartRemoveSlashes($value='')
{
//This function removes slashes placed there by PHP so you can do your own string escaping, and attempts to remove them off of arrays, It's pretty reliable though
return (get_magic_quotes_gpc()) ? (is_array($value) ? array_map("stripslashes", $value) : stripslashes($value)) : $value;
}
$name = SmartRemoveSlashes($_REQUEST['name']);
-
- function SmartRemoveSlashes($value='')
- {
- //This function removes slashes placed there by PHP so you can do your own string escaping, and attempts to remove them off of arrays, It's pretty reliable though
- return (get_magic_quotes_gpc()) ? (is_array($value) ? array_map("stripslashes", $value) : stripslashes($value)) : $value;
- }
-
- $name = SmartRemoveSlashes($_REQUEST['name']);
-
I believe they are entirely removing magic quotes in PHP6 though.
Yes, magic quotes will be removed in PHP 6.
I think that using the mysqli extension is actually more beneficial than relying on mysql_real_escape_string and sprintf as a 'best practice.'
First, you can use mysqli in an object oriented manner out of the box. I can't tell you how many times I've seen other people wrap the standard mysql functions in a wrapper class just to give them an OOP flavor.
Second, it relies on prepared statements for type safety. The 'best practice' example you linked to simulated this with sprintf. Mysqli has this functionality built in.
Finally, it automatically escapes all incoming data. You'll never need to use mysql_real_escape_string again.
I wrote a small test script to illustrate mysqli in action. It inserts entered hyperlinks in a database, then displays those already entered. In a real world example, I'd probably use regular expressions to ensure that a legitimate hyperlink was submitted.
<?php
require_once("data/config.php5");
$mysqli = new mysqli(HOST, USER, PASSWORD, MYDB);
$form = <<<EOF
<html>
<head>
<title>DB test</title>
</head>
<body>
<form action="{$_SERVER['PHP_SELF']}" method="post">
Enter URL: <input type="text" name="url" /><br />
<input type="submit" name="submit" value="submit" />
</form>
</body>
</html>
EOF;
if(isset($_POST['submit']))
{
$url = $_POST['url'];
$query = "INSERT INTO urls (url) VALUE (?)";
$stmt = $mysqli->prepare($query);
$stmt->bind_param("s", $url);
$stmt->execute();
$stmt->close();
$query = "SELECT url from urls";
$stmt = $mysqli->prepare($query);
$stmt->execute();
$stmt->bind_result($link);
$resultOutput = "URL's: <br />";
while($stmt->fetch())
{
$resultOutput .= "$link <br />";
}
$stmt->close();
$resultOutput .= "<br /><br />";
}
echo $form;
if($resultOutput)
{
echo $resultOutput;
}
$mysqli->close();
?>
October 18th, 2008, 12:19 pm
