/    Sign up×
Community /Pin to ProfileBookmark

Need help securing following code (SQL injection)

Copy linkTweet thisAlerts:
Mar 08.2007

Hello! I’ve got a nicely written up MySQL class and a bit of code that gets information from the DB (query with a WHERE id=$id). How can I get the $id from the url? I know I can achieve this with a $_GET[“id”] but I want it to be secure against SQL injection. How can I achieve this? Is there any way of doing this in OOP style? Looking forward to replies!

Thanks,

Sam Granger

to post a comment
PHP

5 Comments(s) ↴

Copy linkTweet thisAlerts:
@NogDogMar 08.2007 — If the ID column is an integer, just cast the value from the URL to an integer:
[code=php]
$id = (int) $_GET['id'];
[/code]
Copy linkTweet thisAlerts:
@Sam_GrangerauthorMar 08.2007 — If the ID column is an integer, just cast the value from the URL to an integer:
[code=php]
$id = (int) $_GET['id'];
[/code][/QUOTE]
Beautyful! It will only be ints so thats perfect! What happens if soeone does enter DROP table eg. as the value of int? Does $id get the value of NULL? or does it get converted into some random number?
Copy linkTweet thisAlerts:
@NogDogMar 08.2007 — Basically, it will read characters from the start of the value until it reaches something that is not a digit. For example:
[code=php]
<?php
$test = array("1;DELETE FROM users WHERE 1", 12.999, 'foobar');
foreach($test as $string)
{
echo (int) $string ."<br>";
}
?>
[/code]
This will output:
<i>
</i>1
12

Copy linkTweet thisAlerts:
@Sam_GrangerauthorMar 08.2007 — Basically, it will read characters from the start of the value until it reaches something that is not a digit. For example:
[code=php]
<?php
$test = array("1;DELETE FROM users WHERE 1", 12.999, 'foobar');
foreach($test as $string)
{
echo (int) $string ."<br>";
}
?>
[/code]
This will output:
<i>
</i>1
12

[/QUOTE]
Ahh cool, thanks! ?
Copy linkTweet thisAlerts:
@MrCoderMar 08.2007 — For other data types use mysql_real_escape_string();
×

Success!

Help @Sam_Granger spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 — BETA 5.28,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @AriseFacilitySolutions09,
tipped: article
amount: 1000 SATS,

tipper: @Yussuf4331,
tipped: article
amount: 1000 SATS,

tipper: @darkwebsites540,
tipped: article
amount: 10 SATS,
)...