Archive | GNU/Linux

My solution is preventing SQL injection without messing with your CMS files. Well, maybe someone who is using PHP would say that is easy, it is just using a function like mysql_real_escape_string or mysqli_real_escape_string. But that works only on a single dimensional array, what about a multi-dimensional array? Well, we need to iterate over array items recursively. So what we will do is preventing SQL injection against a multidimensional array.

Solution

This code does the magic for both single and multidimensional arrays using PHP:

if (!function_exists("clean")) {
//Gets the current configuration setting of magic_quotes_gpc if on or off
if (get_magic_quotes_gpc()) {
function magicquotes_Stripslashes(&$value, $key) {
$value = stripslashes($value);
}
$gpc = array(&$_COOKIE, &$_REQUEST);
array_walk_recursive($gpc, 'magicquotes_Stripslashes');
}
function clean(&$value, $key) {
//here the clean process for every array item
// use mysqli_real_escape_string instead if you use php 7
$value = mysql_real_escape_string($value);
}
}
$req = array(&$_REQUEST);
array_walk_recursive($req, 'clean');

The PHP function used to walk through the request multidimensional array is array_walk_recursive.

Just put this code on the top of your site or header file right after connecting to the database, your file could be up.php or header.php or something similar.

Because if you use this code before the connection occurs, it will show an error because you are using mysql_real_escape_string function which needs a SQL connection.

If you are using PHP 7, you’ll notice that MySQL extension is removed, so in order to make the above code working, you need to replace the function mysql_real_escape_string with mysqli_real_escape_string.

One final thing I have to mention regarding your code, you should keep your SQL parameters on all of your pages between quotes like this:

mysql_query("select * from users where email='$email' order by id");

Notice how the variable $email is quoted.

Without quoting your input like the above statement, SQL injection prevention won’t work.