How to have SQL injection when using php function

0 votes

I'm having sql query as

$login = mysql_real_escape_string(GetFromPost('login'));
$password = mysql_real_escape_string(GetFromPost('password'));

I see somehwere these leads to hack and possible to hack even with mysql_real_escape_string() function used. But I cannot think of any possible exploit?

Sep 23, 2020 in PHP by Rohan
• 120 points
75 views

Hello @Rohan

 You can use prepared statements because the security provision, performance benefits of statement re-use, standardised coding, and library maintainance always out-weigh any other alternative 'short-cut' method.

Thank you for this but Servers don't really do automatic updates as you claimed. Most servers are running LTS versions of Linux so they are still running relatively old PHP versions (lots of servers still on PHP 5.1 or 5.2). If they remove it in the next major release of PHP, there will be enough time to stop using mysql_* functions (and seriously nobody has been using it for years, it's only in legacy code) as it will take time (probably few years) until the new release is rolled into LTS releases

With ints there might be an even better way than that: rather than checking, simply turn it into what you're expecting. $value = (int) $value; or $value = intval($value);. It handles things like negative signs, which ctype_digit won't

Is mysqli_real_escape_string() helps then?

Yes, you can because mysqli_real_escape_string()  just remove that extension in PHP 7.0 

No answer to this question. Be the first to respond.

Your answer

Your name to display (optional):
Privacy: Your email address will only be used for sending these notifications.

Related Questions In PHP

0 votes
1 answer

How to escape strings in SQL Server using PHP?

Hello @kartik, addslashes() isn't fully adequate, but PHP's mssql ...READ MORE

answered Oct 6, 2020 in PHP by Niroj
• 82,560 points
427 views
0 votes
1 answer

How to retrieve or obtain data from the MySQL database using PHP?

Hello kartik,  Actually there are many functions that  ...READ MORE

answered Mar 27, 2020 in PHP by Niroj
• 82,560 points
280 views
0 votes
1 answer

How to send email using php?

Hello @kartik 1.) Download PHPMailer, open the zip file ...READ MORE

answered Apr 1, 2020 in PHP by Niroj
• 82,560 points
198 views
0 votes
1 answer

How can I connect to a Tor hidden service using CURL in PHP?

Hello @kartik, I use Privoxy and cURL to scrape Tor ...READ MORE

answered May 19, 2020 in PHP by Niroj
• 82,560 points
1,337 views
0 votes
1 answer

How to Execute PHP function with onclick?

Hello @kartik, In javascript, make an ajax function, function ...READ MORE

answered Jun 16, 2020 in PHP by Niroj
• 82,560 points
8,342 views
0 votes
1 answer

How to call a php function from ajax?

Hello @kartik, You can't call a PHP function ...READ MORE

answered Jun 16, 2020 in PHP by Niroj
• 82,560 points
4,584 views
+1 vote
2 answers

Scp Php files into server using gradle

Tru something like this: plugins { id ...READ MORE

answered Oct 11, 2018 in DevOps & Agile by lina
• 8,220 points
292 views
0 votes
1 answer

How do I create folder under an Amazon S3 bucket through PHP API?

Of Course, it is possible to create ...READ MORE

answered Apr 24, 2018 in AWS by anonymous
7,352 views
0 votes
1 answer

Failure uploading Image on AmazonS3 with PHP SDK

Try this, I took it out from ...READ MORE

answered May 4, 2018 in AWS by Cloud gunner
• 4,650 points
1,365 views
0 votes
1 answer

Trying to call AWS API via PHP

Try using AWS SDK for PHP, Link ...READ MORE

answered Jun 6, 2018 in AWS by Cloud gunner
• 4,650 points
711 views