, Please 
3
bjrn, on 03 March 2005 - 10:33 PM, said:
If someone is planning on implementing something like this here on their Trap17 account, I suggest you use Pear. When you have people logging into things on your site, you want to make sure that there is no possibility of sql injection. Pear's DB prepared statement function prevents SQL injection attacks. It's very handy.
Something like this could work
Something like this could work
require_once("PEAR.php");
require_once("DB.php");
PEAR::setErrorHandling(PEAR_ERROR_DIE, "Aaaaargh! Error: %s");
$conn = DB::connect("mysql://dbuser:dbpassword@localhost/dbname");
$preparedstatement = $conn->prepare('INSERT INTO dbUsers (username, password, email) VALUES (?, ?, ?)');
$data = array($_POST['username'], $_POST['password'], $_POST['email']);
$conn->execute($preparedstatement, $data);
Please note that I haven't tested this code, it should work, but there might be some stupid typo somewhere. Not too sure about a Trap17 account, however you can just use 'mysql_real_escape_string($myinput)' and that would protect you against SQL injections, you see you have to understand by query a database with text (numeric data obviously is not subjected to this), mysql appreciates everything as a command, like SELECT, FROM AND WHERE are all commands.
This allows the user if no SQL injection protection has been used to issue commands that could read from another database, by using mysql_real_escape_string() or prepare in PDO this sends in the requests as pure text and it's left entirely up to your SQL to actually perform the query, thus eliminating the potential for them to either read from another table, database, or even worse dropping a table or database even (if your privileges are not secure, when using the test database myself, I setup accounts that are only allowed to see certain tables, always think beyond the obvious is my key).
A query can be any type of syntax, like an actual query where you're trying to find the value of something, creating a database, these are all technically in Database logic queries.
Edited by Jez, 07 June 2011 - 10:20 AM.
