This is a safe way to structure mysql_query in PHP

Question

I tried and tried to do SQL injection by making custom queries to a server outside of firefox.

Inside php, all variables are passed to the request in such a line.

Note that $ _POST was not affected at this point.

mysql_query('INSERT INTO users (password, username) VALUES(' . sha1($_POST['password']) . ',' . $_POST['username'] . '));

Is this a safe way to make a change?

Answer 1

You should definitely avoid the mysql_real_escape_string username .

Of course, the best solution would be to use prepared statements. Thus, the separation of the query syntax and data is done at the mysql API level.

, , . .

Answer 2

, , , - POST . , , mysqli (http://php.net/manual/en/book.mysqli.php), prepare + bind.

, , .

: SQL LAMP?

Answer 3

http://php.net/mysqli.real-escape-string, , .

Answer 4

, , , , - , :

INSERT INTO user (password, username) VALUES (abc1234fg00000, admin);

, . , ....

mysql , . , INSERT. , , insert, , . , - POST , ( , magic_quotes, ).

OTOH, , -

"SELECT 1 
FROM users
WHERE username='" . $_POST['username'] . "'
AND password='" . sha1($_POST['username'] . "';";

$_POST ['username'] "admin" 1, .

mysql_real_escape_string(), (, sha1, bas64_encode.... NOT addslashes)

.

Answer 5

, magic_quotes_gpc.
var_dump(ini_get('magic_quotes_gpc')); phpinfo();

, , . .

Answer 6

, , "BIND VARIABLES" , .

This is 2010 people, not 1995.

BIND VARIABLES!

BIND VARIABLES!