Terms of Agreement:
By using this article, you agree to the following terms...
You may use
this article in your own programs (and may compile it into a program and distribute it in compiled format for languages that allow it) freely and with no charge.
You MAY NOT redistribute this article (for example to a web site) without written permission from the original author. Failure to do so is a violation of copyright laws.
You may link to this article from another website, but ONLY if it is not wrapped in a frame.
You will abide by any additional copyright restrictions which the author may have placed in the article or article's description.
Here is a simple, yet effective, solution for avoiding SQL Injections.
Let's see a SQL Injection vulnerable sentence:
$r = mysql_query("SELECT * FROM s WHERE id = ".$_GET['id']."");
And the solution:
$r = mysql_query("SELECT * FROM s WHERE id = UNHEX('".bin2hex($_GET['id'])."')");
By converting the var in php, and reconverting it in the SQL sentence there's no chance to inject code.
THis is great and all, but it doesn't really look so good having lots of PHP functions in your query. I'd suggest you just become a strict PHP coder and put single quotes around the WHERE part and sanitize input with the mysql_real_escape_string() function. (If this comment was disrespectful, please report it.)
Seconding what Jason said. I've used single-quoted field contents passed through MySQL's escaping function and that, coupled with a security module that prechecks form fields for injections, etc. has made my code completely invulnerable to every pen test I've thrown at it. (If this comment was disrespectful, please report it.)
Converting to hex, clever. POST is a more secure way rather than GET but like it :) (If this comment was disrespectful, please report it.)
Add Your Feedback
Your feedback will be posted below and an email sent to
the author. Please remember that the author was kind enough to
share this with you, so any criticisms must be stated politely, or they
will be deleted. (For feedback not related to this particular article, please
click here instead.)
2/6/2009 3:28:30 PM: 
