View source

From phpBB Development Wiki

for Dbal.sql escape

You do not have permission to edit this page, for the following reason:

The action you have requested is limited to users in the group: Users.

You can view and copy the source of this page:

dbal::sql_escape –– Escapes special characters in a string for use in a SQL statement.

==Description==
<pre>string dbal::sql_escape ( string $msg )</pre>
This function is used to create a legal SQL string that you can use in an SQL statement. The given string is encoded to an escaped SQL string. Always use '''$db->sql_escape()''' if you need to check for a string within an SQL statement (even if you are sure the variable cannot contain single quotes - never trust your input). Using this function ensures proper sanitisation and prevents any possible SQL Injection from the input variable.<br>

==Parameters==
{|border="1" cellspacing="0" cellpadding="3"
! Parameter
! Usage
|-
| '''msg'''
| The string to be escaped. Characters encoded are NUL (ASCII 0), \n, \r, \, ', ", Control-Z and DBAL specific SQL escape characters.
|}<br>

==Return Values==
Returns an escaped string.<br>

==Examples==
===Example #1 Usage Example===
<php>$username = request_var('username', '');

$sql = 'SELECT *
    FROM ' . SOME_TABLE . "
    WHERE username = '" . $db->sql_escape($username) . "'";</php><br>

===Example #2 Vulnerable SQL Statement===
<span style="color:red;">This query will fail, because we didn't escape $city</span><br>
This is an example of an SQL Injection
<php>$city = "'s Hertogenbosch";

$sql = 'SELECT state
        FROM ' . MY_TABLE . "
        WHERE city = '$city'";
$result = $db->sql_query($sql);</php>

===Example #3 Already escaped queries===
In this example, the [[dbal.sql_build_array|$db->sql_build_array()]] method already escapes strings used on the input, so using $db->sql_escape is not needed in this instance.
<php>$sql_ary = array(
    'city'  => $city,
    'state' => $state,
);

$sql = 'INSERT INTO ' . MY_TABLE . ' ' . $db->sql_build_array('INSERT', $sql_ary);</php><br>

==See Also==
* [[Database Abstraction Layer]]
* [[request_var]]
<br><br>

[[Category:dbal]]
[[Category:Database]]

[[ja:Dbal.sql_escape]]

Return to Dbal.sql escape.

Retrieved from "http://wiki.phpbb.com/Dbal.sql_escape"