| Asking Devs | Trying to prevent sql injections using PDO

[IAmVolvic]

Hey I am trying to prevent sql injections using PDO
is this a good practise?
​

function esape2($string) {
    return htmlentities($string, ENT_QUOTES, 'UTF-8');
}

$getid = htmlentities($_GET['id']);
$id = esape2($getid);

$findpro = $forum->prepare("SELECT * FROM `store` WHERE `itemid`=:id");
$findpro->bindParam(':id', $id);
$findpro->execute();
$exists = $findpro->rowCount();

 

[MaccariTA]

As long as you use prepared statements properly, you're safe.
In this particular example, you're fine as of SQLi.

It's good to mention that "htmlentities" has nothing to do with SQL injection but XSS.
In addition, you do not need to "htmlentities" input, PDO already escapes id.

If you wish to prevent XSS, you need to "htmlentities" the output, not the input.
Anyhow, I'd recommend using "htmlspecialchars" over "htmlentities" because the latter can cause display problems.

PS: this page is vulnerable to SQLi.

 

[Arrron]

MaccariTA is correct. Use prepared statements - read more here.

 

[Xenons]

Need Services? Connect to our Discord Server and create a ticket CHEAP & RELIABLE - https://discord.gg/9AzX4Gb

At least read the thread before spam replying

 

[IAmVolvic]

As long as you use prepared statements properly, you're safe.
In this particular example, you're fine as of SQLi.

It's good to mention that "htmlentities" has nothing to do with SQL injection but XSS.
In addition, you do not need to "htmlentities" input, PDO already escapes id.

If you wish to prevent XSS, you need to "htmlentities" the output, not the input.
Anyhow, I'd recommend using "htmlspecialchars" over "htmlentities" because the latter can cause display problems.

PS: this page is vulnerable to SQLi.

My Database is MySQL is that still fine?[DOUBLEPOST=1544299556][/DOUBLEPOST]

At least read the thread before spam replying

Tell me about it, Spamming to get buyers is just out right annoying

 

[Callam]

https://gyazo.com/4425ec43c00b73bfdefb1f03aa7bc646

Is the site finished or?

 

[Xazin]

With SQLi and PreparedStatements you can avoid SQL Injection altogether.
Normally you would do this

$name = $_POST['name'];
$mysqli->query("SELECT * FROM myTable WHERE name='$name'");

Where a preparedStatement looks like this

$stmt = $mysqli->prepare("SELECT * FROM myTable WHERE name = ? AND age = ?");
$stmt->bind_param("si", $_POST['name'], $_POST['age']);
$stmt->execute();
//fetching result would go here, but will be covered later
$stmt->close();

What you are doing is using preparedStatement, so you're good to go as far as I can see. I'm not really into PHP, but I do work with professional web developers, and this is basically how we do it in C and Java too.

 

[IAmVolvic]

https://gyazo.com/4425ec43c00b73bfdefb1f03aa7bc646

Is the site finished or?

No going over 40 + pages to fix all the problems changed to PDO

 

[MaccariTA]

My Database is MySQL is that still fine?

Yes.
The fact that you use MySQL only differs in the PHP functions you use for prepared statements.