Is SQL injection (oneliner) safe?

Question

PHP:

$ SQL = "SELECT goodies FROM stash WHERE secret = '".  
    str_replace ("'",' ', $ _ POST [' secret ']).  
"'";  

Can an evil genius hacker embed SQL in my SELECT - How?

Answer 1

I had some time to think about it, and I see no way to embed SQL in this statement.

SQL, , , (\' ''). , . , , SQL-.

:

• .
• - escape-.
• , - .
• , SQL-.

:

$SQL = "SELECT goodies FROM stash WHERE secret='" .  
    str_replace("'",'',$_POST['secret']) .  
"' AND secret2 = '" .
    str_replace("'",'',$_POST['secret2']) .  
"'";  

\ OR 1 = 1 --, :

SELECT goodies FROM stash WHERE secret='\' AND secret2=' OR 1 = 1 -- '

MySQL :

SELECT goodies FROM stash WHERE secret='...' OR 1 = 1

, , SQL.

, , . SQL-.

Answer 2

mysql_real_escape_string() ? .

Answer 3

May be. The best way:

$query = sprintf("SELECT goodies FROM stash WHERE secret='%s'",
addcslashes(mysql_real_escape_string($_POST['secret']),'%_'));

Answer 4

Why just do not use mysql_escape_string? And yes, he could add "instead 'and plus, this request will give you an error, I think.