Testing MySQL and preventing string from crashing it.

[Sims]

Hi,

I read somewhere that there are some tricks that a hacker can use to break
into the db table.
But how can i test against that? Is there a function to convert all strings
to 'safe' strings?

Can errors occur with integers or string only?

My main worry is for legitimate users that wish to save something that might
cause an error.

Can apostrophes, (" and ' ), cause errors? can a user wanting to save a
legitimate SQL query highjack my queries?

Your input will be greatly appreciated.
Many thanks

Sim

[Cameron]

Sims wrote:

Hi,

I read somewhere that there are some tricks that a hacker can use to break
into the db table.
But how can i test against that? Is there a function to convert all strings
to 'safe' strings?

Can errors occur with integers or string only?

My main worry is for legitimate users that wish to save something that might
cause an error.

Can apostrophes, (" and ' ), cause errors? can a user wanting to save a
legitimate SQL query highjack my queries?

Your input will be greatly appreciated.
Many thanks

Sim

One of the methods you can use is escaping the string

MySQL:
http://uk2.php.net/manual/en/functio...ape-string.php

PostgreSQL
http://uk2.php.net/manual/en/functio...ape-string.php

but it's always advisable to do extra validation along with this

~Cameron