sprintf for SQL injection testing

Hello all -
>
I'm looking at web pages describeing how to prevent SQL injections
with PHP. All of them metion mysql_real_escape_string. However, I
recall mention of sprintf at some time in the past.
>
Is mysql_real_escape_string sufficient to prevent injections, or
should $_POST or $_GET data also be checked with sprintf ?
>

Hello all -
>
I'm looking at web pages describeing how to prevent SQL injections
with PHP. All of them metion mysql_real_escape_string. However, I
recall mention of sprintf at some time in the past.
>
Is mysql_real_escape_string sufficient to prevent injections, or
should $_POST or $_GET data also be checked with sprintf ?

>I'm looking at web pages describeing how to prevent SQL injections
>with PHP. All of them metion mysql_real_escape_string. However, I
>recall mention of sprintf at some time in the past.
>
>Is mysql_real_escape_string sufficient to prevent injections, or
>should $_POST or $_GET data also be checked with sprintf ?

I am not sure if sprintf() is the right way to avoid injection, but
without an example, I cannot tell. ;-)

On Apr 14, 11:29 am, Erwin Moller
<Since_humans_read_this_I_am_spammed_too_m...@spam yourself.comwrote:
>>
>
Well, IIRC, it wasn't specifically for SQL injection, but rather for
any sort of malformed data.
>
Something like
>
$sql = sprintf( "INSERT INTO table ( field1, field2 ) VALUES ( '%s',
%d )", $_POST['string'], $_POST['number'] );
>

lawp...@gmail.com schreef:
>>>>>>
Hi,
>
But if $_POST["string"] contains:
bla',2);delete from table;--
>
you still have SQL injection. :-/
I think.
(Not 100% sure, I seldom need sprintf.)
>
Regards,
Erwin Moller

>
Right. Maybe SQL injection wasn't the concern it was supposed to
address, but instead a buffer overflow or something like that.

lawp...@gmail.com wrote:
>>
Or then again, maybe not.

On Apr 14, 5:29 pm, "Paul Lautman" <paul.laut...@btinternet.com>
wrote:
>>>>
Well, you can use it to prevent SQL injection when you are doing type
checking:
>
<?
$input = "'5'; DELETE FROM table;";
>
$sql = "UPDATE table SET value = $input WHERE id = 12";
>
echo $sql . "\n";
?>
>
UPDATE table SET value = '5'; DELETE FROM table; WHERE id = 12
>
<?
$input = "''; SELECT * FROM table;";
>
$sql = sprintf( "UPDATE table SET value = %d WHERE id = 12", $input );
>
echo $sql . "\n";
?>
>
UPDATE table SET value = 0 WHERE id = 12
>
Although, you wouldn't want a 0 value being updated. Much preferrable
is a syntax error where no value is changed.

On Apr 14, 5:29 pm, "Paul Lautman" <paul.laut...@btinternet.com>
wrote:>
Well, you can use it to prevent SQL injection when you are doing type
checking:

<?

Although, you wouldn't want a 0 value being updated. Much preferrable
is a syntax error where no value is changed.

On Apr 14, 5:29 pm, "Paul Lautman" <paul.laut...@btinternet.com>
wrote:
>>>>
Well, you can use it to prevent SQL injection when you are doing type
checking:

On Apr 15, 9:28 am, lawp...@gmail.com wrote:
>
>
>>>>>>>>>>>>>>>
From the PHP site,
>
<?php
// Connect
$link = mysql_connect('mysql_host', 'mysql_user', 'mysql_password')
OR die(mysql_error());
>
// Query
$query = sprintf("SELECT * FROM users WHERE user='%s' AND
password='%s'",
mysql_real_escape_string($user),
mysql_real_escape_string($password));
?>