Evitarea injectiilor sql

[InBuzunar.Mobi]

Inlocuiti obisnuitele

$test = $_GET['test'];
$test = $_POST['test'];
$test = $_REQUEST['test'];

cu

$test = mysql_real_escape_string($_GET['test']);
$test = mysql_real_escape_string($_POST['test']);
$test = mysql_real_escape_string($_REQUEST['test']);

sau

function sqltest($x)
{
return "'".mysql_real_escape_string($x)."'";
}
echo "".sqltest($_GET['test'])."";
echo "".sqltest($_POST['test'])."";
echo "".sqltest($_REQUEST['test'])."";

Intr-o fila config.php sa zic,adaugati

if(!get_magic_quotes_gpc())
{
if(is_array($_GET))
{
while(list($k, $v) = each($_GET))
{
if(is_array($_GET[$k]))
{
while(list($k2, $v2) = each($_GET[$k]))
{
$_GET[$k][$k2] = addslashes($v2);
}
@reset($_GET[$k]);
}else{
$_GET[$k] = addslashes($v);
}
}
@reset($_GET);
}
if(is_array($_POST))
{
while(list($k, $v) = each($_POST))
{
if(is_array($_POST[$k]))
{
while(list($k2, $v2) = each($_POST[$k]))
{
$_POST[$k][$k2] = addslashes($v2);
}
@reset($_POST[$k]);
}else{
$_POST[$k] = addslashes($v);
}
}
@reset($_POST);
}
}

sau

ini_set("display_errors", "0");
if(!get_magic_quotes_gpc())
{
$_GET = array_map('trim', $_GET);
$_POST = array_map('trim', $_POST);
$_COOKIE = array_map('trim', $_COOKIE);

$_GET = array_map('addslashes', $_GET);
$_POST = array_map('addslashes', $_POST);
$_COOKIE = array_map('addslashes', $_COOKIE);
}

Si/ori in htaccess adaugati

IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*
<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>
<Files images>
deny from all
</Files>
<Files *.php>
deny from all
</Files>
<Files *.php.*>
deny from all
</Files>
<Files *.php.php.*>
deny from all
</Files>
magic_quotes_gpc = On

[DotBoost]

Sau folositi PDO si prepared statement, si gata treaba, fara alte complicatii.

[Marian]

 Nu este mai simplu asa ?!

fisier: clean.php

<?php
  function clean($str) {
          $str = @trim($str);
       if(get_magic_quotes_gpc()) {
    $str = stripslashes($str);
      }
  return mysql_real_escape_string($str);
 }
?>

se include fisierul clean.php si apoi este simplu:

exemple:
$ceva = clean($_REQUEST['ceva']);
$ceva = clean($_POST['ceva']);

------------------------------------------------------------------------

// Apropo de fisiere si deny din .htaccess, as adauga si astea:

<Files ~ "^(.*)\.(inc|tpl|sql)$">
 Order deny,allow
 Deny from all
</Files>

[Marian]

Inlocuiti obisnuitele cu sauIntr-o fila config.php sa zic,adaugatisauSi/ori in htaccess adaugati
..............................

<Files *.php>
deny from all
</Files>

 Sincer, asta este cea mai tare protectie sql injection vazuta vreodata 
Daca adaugi si extensia .html ai cel mai secure site posibil

[Gupi]

Sincer, asta este cea mai tare protectie sql injection vazuta vreodata 
Daca adaugi si extensia .html ai cel mai secure site posibil

Marian, poti pune un prezervativ pe mufa de retea ...