mysqli::real_escape_string, is the new standard function for escaping, and is allot better but not infallible. And here's why...
SQL queries are their own language, and they written with both humans and machines in mind. Most queries are written and parsed via code. In php you write code that then writes its own code, that's then executed by the DB engine.
SQL is meant to execute parameters it's fed. This means if you don't want it to do something you have to limit the instructions it's sent. The example I gave for recovering accounts is actually not too dissimilar to a real SQL query. You can attach seemingly endless amounts of parameters into a query. You are actually mixing and matching PHP and SQL in both query and execution.
Since it's all server side the potential power is huge, not only are you accessing a DB, you are running server side code. Thus the potential for risk.
I wrote my own escaping/filter for my DB requests because my queries are very specific. But my pages sanitise everything first. You can't even do an invalid hiscore lookup on my site. Try and enter a 13 character name in my hiscores or use non alpha numeric characters. This input is sanitised twice and there is no SQL taking place.
By the time the SQL engine is fired up, there have been numerous sanitation methods used and the final query/request will have heavy limitations in place. And will be quadruple checked before handing it over to SQL.
My point is many layers of protection are needed, because at the end of the day, what goes into my DB was generated by user input. And that's the thing, there is no one size fits all sanitation method. Every site and DB is unique and coding structures are too. Code that writes and executes code is fun and very handy, but my code wont work for someone else, my approach and concept may work, but not the routines.
Wow another essay post from me, and tbh it's a crude explanation, and not entirely accurate, but conceptually it's kind of on track.
24-Jan-2014 09:34:42
- Last edited on
24-Jan-2014 09:36:33
by
Indecent Act