[RESOLVED] mySQL injection protection. Am I thinking right

[igorlopez]

Hi,

I am trying to prevent mySQL injections and have this construction on a page when accessed with a GET url.

$stmt1 = $dbh->prepare("SELECT gId FROM Groups WHERE gName = ?");
$stmt1->execute(array($_GET[forum]));
if ($row = $stmt1->fetch(PDO::FETCH_ASSOC))
{
	// No mySQL injection attempted and forum is valid
	$_SESSION['currentForum'] = $_GET[forum];
}
else
{
	// Bad Bad client. Redirect to ..... well just return to main page for now
	unset($_SESSION['currentForum']);
	header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
	header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); // Date in the past
	header("Location: ". $_SESSION['myPage'] . 'index.php');
}

Is this safe? $dbh is a PDO object and from what I have understood it should prevent injections but I don't know how. At this point I am assuming that the query will fail if not the $_GET['forum'] matches one entry in column gName exactly.
The field gName in table Groups is what I am using to populate the url for this page. by using following code.

// Build list of availible forums and start with the public forums
// available to everybody
$stmt1 = $dbh->prepare("SELECT gName,gTextTag FROM Groups WHERE gVisi = 'PUB'");
$stmt1->execute();
$firstRow = TRUE;
while ($row = $stmt1->fetch(PDO::FETCH_ASSOC))
{
	$gName = $row['gName'];
	$gTextTag = $row['gTextTag'];
	// Just to prettify output, position of echo for the first echo is based on
	// position in header file this is used. No space padding for first row
	if ($firstRow)
	{
		$str = "<li><a href=\"forum.php?forum=" . $gName . "\">" . $_lg[$gTextTag] ."</a></li>\n";
		$firstRow = FALSE;
	}
	else
	{
		$str = "                  <li><a href=\"forum.php?forum=" . $gName . "\">" . $_lg[$gTextTag] ."</a></li>\n";
	}
	echo $str;
}

Thanx for any input.

[Concat]

It looks like an good solution.
But I would use class.inputfilter.php to remove most unwanted input.

include("class.inputfilter.php");
$myFilter = new InputFilter($tags, $attr, $tag_method, $attr_method, $xss_auto);

$input_data = $myFilter->process(trim($_GET[forum]));
$input_data_more = $myFilter->process(trim($_GET[field]));

$sStop = microtime(); 
$time_elapsed = round(($sStop - $sStart), 4);

echo $input_data;

';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//></SCRIPT>!--<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}

[igorlopez]

Thank you, I'll have a look into that class once I get my hands on it. (mirror problem at the moment)
I am sure it will come handy.

[zzz]

Yes, input filter works great.