Solved

PHP/MySQL Query and SQL Injection

Posted on 2010-09-07
4
380 Views
Last Modified: 2013-12-13
Is this a really bad query?

SELECT * FROM categories WHERE categoryID = 5

Could something like this leave me vulnerable to SQL Injection?  How do I prevent it?  I'm using Dreamweaver to create my PHP pages and then customizing when necessary.  
0
Comment
Question by:ssailer
  • 2
4 Comments
 
LVL 24

Accepted Solution

by:
slyong earned 400 total points
Comment Utility
Well the query itself is not vulnerable to SQL Injection.  However, if you are doing your PHP like this:

$query = "SELECT * FROM categories WHERE categoryID = " . $catID;

There is a possibility that someone put in a query string to do the injection.  A fast way to prevent SQL injection would be:

$catID = mysql_real_escape_string($catID);
$query = "SELECT * FROM categories WHERE categoryID = " . $catID;

0
 

Author Comment

by:ssailer
Comment Utility
So, if I enter a fixed value, instead of a parameter, it should be okay?
0
 
LVL 24

Expert Comment

by:slyong
Comment Utility
Yup
0
 
LVL 3

Assisted Solution

by:ncollings
ncollings earned 100 total points
Comment Utility
If the query is hard coded in your php and non of the parameters come from the browser then it would be very difficult to exploit.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

Part of the Global Positioning System A geocode (https://developers.google.com/maps/documentation/geocoding/) is the major subset of a GPS coordinate (http://en.wikipedia.org/wiki/Global_Positioning_System), the other parts being the altitude and t…
Since pre-biblical times, humans have sought ways to keep secrets, and share the secrets selectively.  This article explores the ways PHP can be used to hide and encrypt information.
Learn how to match and substitute tagged data using PHP regular expressions. Demonstrated on Windows 7, but also applies to other operating systems. Demonstrated technique applies to PHP (all versions) and Firefox, but very similar techniques will w…
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now