Re: PHP for preventing SQL injections?

[wilfrid <wilfrid () digifactory fr>]

For this kind of request, if your $id is an INT, you can avoid all 
injjection by an intval() :

$string = "SELECT * FROM tblTable WHERE ID=".intval($id);

if $id contains non-number caracters, it will return 0.

Wilfrid.

Security OnLine.tk a écrit:

> I know something to use in ASP, but it could be good also in PHP
> in ASP, you got a string with the SQL commands:
>
> string = "SELECT * FROM tblTable WHERE ID=' & id & '"
>
> to prevent a SQL injection attack:
>
> string = "SELECT * FROM tblTable WHERE ID=(' & id & ')"
>
> in PHP you could do something like this
>
> $sql_cmds = "SELECT * FROM tblTable WHERE ID=(' . id . ')";
>
> check if this works
>
> David a.k.a. hanska
>
>
> -------Original Message-------
>
> From: Lefevre, Steven
> Date: martedì 16 settembre 2003 23.38.58
> To: webappsec () securityfocus com
> Subject: PHP for preventing SQL injections?
>
> Hey folks -
>
> Does anyone know of a regexp for checking SQL strings for injection
> attempts?
>
> Steve Lefevre
> Network Administrator
> IMI International, Inc.
> 614.839.2500
>
> .
>
>