How Secure is this MySQL statement in a PHP script?

Question

How secure is this MySQL statement built in a PHP? Would it be vulnerable to an SQL injection?

$sql = sprintf("INSERT IGNORE INTO my_table VALUES(%d, %d, 1, NOW())", 
                 mysql_escape_string($_SESSION['client']['id']), 
                 mysql_escape_string($_POST['id']));

Al. · Accepted Answer · 2009-07-29 16:04:15Z

3

Yes because %d only results in a number there is no need to escape the string. Using single quotes would provide a speed improvement too. So a safe and fast way is:

$sql = sprintf('INSERT IGNORE INTO my_table VALUES(%d, %d, 1, NOW())', $_SESSION['client']['id'], $_POST['id']);

answered Jul 29, 2009 at 16:04

Al.

2,8822 gold badges22 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Salaryman Over a year ago

Got any recent benchmarks for your claim on single quotes improving speed in this instance?

jimyi Over a year ago

No benchmarks, but it's more of a common sense thing. Before sending the string to sprintf - with double quotes, the interpreter will try to look for $variables and other escaped sequences. The single quotes, it won't. Though the speed difference is too small to really make a difference.

Cristian Toma · Accepted Answer · 2009-07-29 15:58:14Z

1

No it shouldn't be vulnerable.

Here is a detailed article on how to secure your SQL queries in PHP.

http://www.tech-evangelist.com/2007/11/05/preventing-sql-injection-attack/

answered Jul 29, 2009 at 15:58

Cristian Toma

5,8892 gold badges38 silver badges43 bronze badges

Comments

John Carter · Accepted Answer · 2009-07-29 15:58:53Z

1

It looks fine to me.

In fact, is there any need to use mysql_escape_string in this case, since sprintf("%d") can only result in a number?

answered Jul 29, 2009 at 15:58

John Carter

55.7k28 gold badges116 silver badges144 bronze badges

Collectives™ on Stack Overflow

How Secure is this MySQL statement in a PHP script?

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related