Basic PHP sql injection question

Question

I have been doing a bit of research on SQL injections and so far all I can see is when you are concatenating query strings with variables, you have problems.

My question(s) is/are:

If I have this code:

$query  = "SELECT id, name, inserted, size FROM products";
$result = odbc_exec($conn, $query);

Am I subject to sql injection? I didn't think so but I found a post on stackoverflow that indicated that it was.

Now if I have this code:

$variable = "name";
$query = "SELECT"' .$variable. ' FROM products";
$reulst = odbc_exec($conn, $query);

Am I still stubject to injection? It seems to me that I have full control of that variable and the code is run on the server side so that would be safe. Is this correct?

Thanks in advance for any input!

No. If a query doesn't contain any user-provided data, then it cannot be injected. Your second version IS vulnerable to injection, but only if the data YOU'VE provided contains vulnerable data. But it's not user-provided data, so it's "most likely" safe. — Marc B
– Marc B, Commented Aug 19, 2011 at 15:19
Note that instead of $query = "SELECT"' .$variable. ' FROM products"; you can also use this syntax: $query = "SELECT '$variable' FROM products"; — Johan
– Johan, Commented Aug 19, 2011 at 15:23

Pekka · Accepted Answer · 2011-08-19 15:20:05Z

6

SQL injection is usually a problem if you have input from a source you can't trust. Seeing as this is the case in neither of your examples, you're fine as far as malicious attacks go.

However, it is good practice to escape $variable before inserting it into the query string even if you control it.

answered Aug 19, 2011 at 15:20

Pekka

451k150 gold badges989 silver badges1.1k bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Nathaniel Wendt Over a year ago

confirmed what I was leaning towards. Thanks!

producerism · Accepted Answer · 2011-08-19 15:20:02Z

2

You are prone to sql injection if you allow any user input into your queries at all. With the two examples provided, nothing is being input from the user, so these are both safe.

answered Aug 19, 2011 at 15:20

producerism

3444 silver badges17 bronze badges

Comments

Oded · Accepted Answer · 2011-08-19 15:20:15Z

2

The first query is not subject to injection as there are no dynamic parts to it.

The second is. Even if you think you have full control over your variable, if you are using user supplied data (whether coming from form sumbit, cookies etc...), you can be vulnerable.

Always use parameterized queries through a SQL library that will ensure data is safely escaped.

answered Aug 19, 2011 at 15:20

Oded

501k102 gold badges900 silver badges1k bronze badges

Comments

Saul · Accepted Answer · 2011-08-19 15:26:48Z

1

The only case when a query can get exposed is when parts of it are passed from input.

$variable = $_GET["name"];
$query = "SELECT " .$variable. " FROM products";  // now things can get bad
$reulst = odbc_exec($conn, $query);

One correct way of using input variables inside a query would be to escape them:

$variable = addslashes($_GET["name"]); // sanitizing input
$query = "SELECT " .$variable. " FROM products";  // all good here
$reulst = odbc_exec($conn, $query);

edited Aug 19, 2011 at 15:26

answered Aug 19, 2011 at 15:21

Saul

18k8 gold badges67 silver badges93 bronze badges

Comments

Craig · Accepted Answer · 2011-08-19 15:20:42Z

0

The issue is "where do the values of your variables come from?" If you are using user-submitted data in a query, then you need to be careful how you use it. In your case, you're safe as far as I can tell.

answered Aug 19, 2011 at 15:20

Craig

3,3176 gold badges31 silver badges44 bronze badges

1 Comment

Craig Over a year ago

Sorry for the duplicate answer. We all hit "Submit" at about the same time. :-)

Adam Fabicki · Accepted Answer · 2011-08-19 15:20:43Z

0

For the first example, no, you won't be subject to any SQL injection because there is nothing a user could input to change your query.

In the second case, you're only subject to injection if $variable is derived from some user input.

answered Aug 19, 2011 at 15:20

Adam Fabicki

5303 silver badges10 bronze badges

Comments

Drewdin · Accepted Answer · 2011-08-19 15:23:51Z

0

Any time you take user input straight into your $query you are susceptible to sql injection. The first code you show is fine, its a straight query, there is no way for the user to input any harmful code.

$query  = "SELECT id, name, inserted, size FROM products";
$result = odbc_exec($conn, $query);

But the second code snippet (if $variable is taken from a form ) anyone could enter in harmful code and kill your database.

$variable = $_POST['name']; **for instance, this would be bad!
$query = "SELECT"' .$variable. ' FROM products";
$reulst = odbc_exec($conn, $query);

How does $variable get its value?

answered Aug 19, 2011 at 15:23

Drewdin

1,7625 gold badges23 silver badges35 bronze badges

1 Comment

Drewdin Over a year ago

wow, i started typing and when i was done there were 7 answers! you guys are fast!!

Collectives™ on Stack Overflow

Basic PHP sql injection question

7 Answers 7

1 Comment

Comments

Comments

Comments

1 Comment

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

7 Answers 7

1 Comment

Comments

Comments

Comments

1 Comment

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related