[PHP] Share you Anti-SQL injection function.

well the title says it all
i want to see how different people handle injection

*educational purposes

[Only registered and activated users can see links. Click Here To Register...]

Quote:

Originally Posted by situsavais [Only registered and activated users can see links. Click Here To Register...]

i know how it works , i did my search thank you.
i just wanted to see how others do it.

Do you want clean db ?!

Quote:

Originally Posted by BranzUK Do you want clean db ?!

:confused:

Quote:

Originally Posted by B13. i just wanted to see how others do it.

others do it by using pdo with prepared statements. thats about it

I usually use the Laravel framework, so I don't have to think that much about that issue. Link here: [Only registered and activated users can see links. Click Here To Register...]

"Share with me cause I have no idea how to do it".

Quote:

Originally Posted by WickedNite. "Share with me cause I have no idea how to do it".

i got a working function
compared them to uploaded websites i know how to do it
don't assume stuff from your head.
don't throw flames in the thread.
as i said
*educational purposes*

Quote:

Originally Posted by Syc others do it by using pdo with prepared statements. thats about it

i think that is the most common way
then comes the string edits

Quote:

Originally Posted by Sycrog I usually use the Laravel framework, so I don't have to think that much about that issue. Link here: [Only registered and activated users can see links. Click Here To Register...]

doesn't it do the same thing ?

Quote:

Note: The Laravel query builder uses PDO parameter binding throughout to protect your application against SQL injection attacks. There is no need to clean strings being passed as bindings.

[Only registered and activated users can see links. Click Here To Register...]

Yes, I assumed that Laravel is using PDO to handle that, but the message was rather to use a proven framework instead of trying to build solutions again and again.

use PDO Prepared statements if you don't want to learn a new framework :3

Why recreate the wheel when there is something which do the work, and it's called "PDO".

Laravel ORM handle well sro db ? I mean for the relation ect.. The architecture of Joymax db arn't following some rule so.. I doubt that an orm can handle all this shit nah ?

Quote:

Originally Posted by situsavais Why recreate the wheel when there is something which do the work, and it's called "PDO". Laravel ORM handle well sro db ? I mean for the relation ect.. The architecture of Joymax db arn't following some rule so.. I doubt that an orm can handle all this shit nah ?

Yes, you can perfectly use Laravel with sro db, i've done it before and the relationships work well. Laravel is very powerfull, more than people think.

PDO

Very good post about PDO - [Only registered and activated users can see links. Click Here To Register...]
LSS

Quote:

Prepared statements / parameterized queries are generally sufficient to prevent 1st order injection on that statement*. If you use un-checked dynamic sql anywhere else in your application you are still vulnerable to 2nd order injection.

This why everyone fail, because he think is 100% secure, there is no such things yet.