What are the methods to check user input and prevent mysql injection?

Question

"We should never trust user's input", this is what I read from somewhere on the web.

Currently I have a web form, they enter their username and emails. For username field, how to control, check and prevent mysql injection?? Currently, in my php script I only do this:

$username = mysql_real_escape_string($_POST['username']); // prevent mysql injection

I saw some tutorials, before the mysql_real_escape_string function, they include other functions like, htmlentities, etc (could not remember what it is, and I cant found it now, sigh)

Is this a must to include the so called "htmlentities" function before mysql_real_escape_string??

What is your method you usually use for checking user's input data?

Oh ya, some other functions:

stripslashes();
serialize();
urlencode();

Must i include those?

Please search before asking a new question. stackoverflow.com/search?q=sql+injection — Rob Kennedy
– Rob Kennedy, Commented Jul 8, 2009 at 4:52

chaos · Accepted Answer · 2012-07-10 21:56:36Z

11

You're doing it right, as far as putting your data into the database is concerned. You're protected against SQL injection attacks.

htmlentities() and htmlspecialchars() aren't relevant to SQL injection attacks; they're relevant to XSS attacks, which is a whole other topic you should look into, and is a relevant issue if you're displaying user input back out to the web.

edited Jul 10, 2012 at 21:56

answered Jul 8, 2009 at 4:55

chaos

125k34 gold badges306 silver badges310 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Artem Russakovskii Over a year ago

Couldn't have put it better myself. en.wikipedia.org/wiki/Cross-site_scripting

jingleboy99 Over a year ago

what are the others attack beside sql injection and XSS?? if i include the htmlentities() and htmlspecialchars() will it prevent XSS attacks??

chaos Over a year ago

For other forms of attack, see this question: stackoverflow.com/questions/438073/…. htmlentities() and htmlspecialchars() should be used when you're producing output, not receiving input, and you wouldn't use both at the same time. In order to have much hope of any of these methods actually protecting you, you will need to treat them less as magic rituals and work more to understand what they do, and why and how they should be applied.

si618 · Accepted Answer · 2009-07-08 05:09:06Z

2

You could also look at using prepared statements (I think equivalent to parameterized queries for SQL Server), which further reduces the attack surface.

answered Jul 8, 2009 at 5:09

si618

16.9k12 gold badges70 silver badges84 bronze badges

Comments

bumperbox · Accepted Answer · 2009-07-08 05:00:12Z

1

like @chaos said is right

you can also use database abstraction layers, like pdo that will escape the paramaters for you

answered Jul 8, 2009 at 5:00

bumperbox

10.2k6 gold badges46 silver badges66 bronze badges

Collectives™ on Stack Overflow

What are the methods to check user input and prevent mysql injection?

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related