SQL Injection Protection - single quotes [duplicate]

Question

Possible Duplicate:
Best way to prevent SQL injection in PHP?

Ive been doing a bit of testing to protect my sites from SQL Injection. I see there are a couple of ways of doing so, Escaping my user inputs, adding slashes, or better yet using parameterized sql statements.

I had this test code..

$q=$_GET["q"];
$game = mysql_query("SELECT * FROM `Games` WHERE `id` = '$q'");
$game = mysql_fetch_array($game);

echo "<h4>ID: ".$game[0]."<br /></h4>name: " . $game[1];

And I tried several SQLi requests and could not get my test page to error, or show any extra data.

But when i changed my sql statement code to this (Removed the single quotes around $q)..

$game = mysql_query("SELECT * FROM `Games` WHERE `id` = $q");

I could perform simple SQLi's and get some results.

So is just wrapping my user inputs in single quotes good enough? Or have i over looked more complex SQLi techniques?

Answer 1

You are mentioning SQL injection and parameterized statements, but does not seem to be across PDO? - Use PDO http://www.php.net/manual/en/pdo.prepare.php

Answer 2

Try this input:

abc' OR id <> '

it will lead to following statement:

"SELECT * FROM `Games` WHERE `id` = 'abc' OR id <> ''"

That would return all games instead of only one. If your page allows to show the whole result, then we would definitely see too much...

The way out is to use PDO with prepared statements, are at least the mysqli_real_escape_string() function before inserting the user input into the SQL statement.

SQL-Injection can do a lot more, in the worst case you can even get control over the server. Have a look at this SQL Injection Cheat Sheet