MySQL query security...

[Anon]

i have my search on my site. im putting users search keywords to mysql query. i want to ask my controls before sending it to database. whis characters are unsecure for this. maybe ";" is one of them.

[[deleted]]

PHP's mysql interface is not capable of executing more than one SQL statement at a time, so this:

mysql_query("select * from bla; drop table bla");

will not drop table 'bla'.

[Anon]

maybe

keyword will be " ); unlink ("search.php"); ?

does it delete my search.php ?

or does any character give an error in mysql query ?

[[deleted]]

It will just give an error in mysql_query(). Nothing more.

[Anon]

i dont want to have simple errors like this in my site.

do you think my search.php must begin like this?

<? php
$stmt="Select names from table where search_keyword=$search_keyword";

bla bla....

mysql_query($stmt,$link);

bla bla...

?>

[[deleted]]

I don't understand what you mean.

[Anon]

I am also not sure what you mean, but could

<?php
$search_keyword = addslashes($search_keyword);

$stmt="Select names from table where search_keyword=$search_keyword";

bla bla....

mysql_query($stmt,$link);

bla bla...

?>
be the solution?

[Anon]

Hi Guys ..

There is NO SOLUTIONS for this !!!

🙂

Jerome wrote:

I am also not sure what you mean, but could

<?php
$search_keyword = addslashes($search_keyword);

$stmt="Select names from table where search_keyword=$search_keyword";

bla bla....

mysql_query($stmt,$link);

bla bla...

?>
be the solution?

[elsad]

sorry for my poor english :-)

my question is so simple ...

is it secure to put everything (writed by users) to query without any control ?

some people saying that i must $searchkeyword=htmlspesialchars(addslashes($search_keyword)) before putting them to query?

something else ?

[[deleted]]

That's only because there is no problem.

[elsad]

sorry for my poor english :-)

my question is so simple ... i'll try ask it again :-)

is it secure to put everything (writed by users) to query without any control ?

some people saying that i must $searchkeyword=htmlspesialchars(addslashes($search_keyword)) before putting them to query?

something else ?