Re: PHP for preventing SQL injections?

["Security OnLine.tk" <securityonline () email it>]

I know something to use in ASP, but it could be good also in PHP
in ASP, you got a string with the SQL commands:
 
string = "SELECT * FROM tblTable WHERE ID=' & id & '"
 
to prevent a SQL injection attack:
 
string = "SELECT * FROM tblTable WHERE ID=(' & id & ')"
 
in PHP you could do something like this
 
$sql_cmds = "SELECT * FROM tblTable WHERE ID=(' . id . ')";
 
check if this works
 
David a.k.a. hanska
 
 
-------Original Message-------
 
From: Lefevre, Steven
Date: martedì 16 settembre 2003 23.38.58
To: webappsec () securityfocus com
Subject: PHP for preventing SQL injections?
 
Hey folks -
 
Does anyone know of a regexp for checking SQL strings for injection
attempts?
 
Steve Lefevre
Network Administrator
IMI International, Inc.
614.839.2500
 
.



--
Email.it, the professional e-mail, gratis per te: http://www.email.it/f

Sponsor:
Sconti fino al 20% per i magnifici bouquet di Artefiori! Clicca qui!
Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=750&d=16-9