Check if SQL input is valid SQL [duplicate]

Question

Is there any Regular Expression to check if a string is valid SQL? It must be PHP compatible. My code.

if(!preg_match("regular expression", $_POST['sql_input']){
    echo "Please enter valid SQL.";
    exit;
}

There are many dialects of SQL, any particular one you have in mind? — Joachim Isaksson
– Joachim Isaksson, Commented Feb 4, 2014 at 16:19
What are you doing to be doing with these posted SQL queries? DELETE FROM users; and DROP DATABASE database are valid queries ;) — gen_Eric
– gen_Eric, Commented Feb 4, 2014 at 16:19

Community · Accepted Answer · 2017-05-23 10:31:42Z

0

You could try this library: http://code.google.com/p/php-sql-parser/. I've not used it yet so I can't guarantee it but the code looks like it will be able to tell the difference between valid and invalid SQL.

Another option could be to use transactions if your SQL variant allows it. A transaction would allow you to execute the SQL and then cancel it afterwards reversing any damage that was done. I think I would prefer option 1 though.

I am quoting Godwin. Source

edited May 23, 2017 at 10:31

CommunityBot

11 silver badge

answered Feb 4, 2014 at 16:21

Langusten Gustel

11k9 gold badges48 silver badges62 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Joachim Isaksson Over a year ago

Re: transactions, most (all?) databases won't allow you to roll back for example DROP DATABASE.

sigy · Accepted Answer · 2014-02-04 16:24:52Z

0

No, it is impossible. But if you want to protect yourself against SQL injection attacks, there are other mechanisms you should use.

See for example: https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

answered Feb 4, 2014 at 16:24

sigy

2,5092 gold badges27 silver badges57 bronze badges

Comments

remedy. · Accepted Answer · 2014-02-04 16:39:40Z

0

Simple answer. What you are trying to do is not possible.

You need an SQL Parser to check if statements are valid.

Check here: http://www.dpriver.com/blog/list-of-demos-illustrate-how-to-use-general-sql-parser/vendor-specific-offline-sql-syntax-check/

edited Feb 4, 2014 at 16:39

answered Feb 4, 2014 at 16:21

remedy.

2,0223 gold badges28 silver badges50 bronze badges

7 Comments

Funk Forty Niner Over a year ago

Actually, it is possible (with the right sequence of 0's and 1's anything is possible nowadays ;-). I made a script using an array of keywords, and if one was found, then it would do whatever I told it to do. It could easily be modified to suit the OP's wish. Btw, I did NOT downvote this. It's not my style. ;-)

STT LCU Over a year ago

If you want to say that something is not possible, you have to demonstrate it. The other answer(s) disagree with you. (I'm the downvoter)

Joachim Isaksson Over a year ago

@STTLCU Well, to be fair I don't see a disagreeing answer that actually shows a regex or any pointer to how to construct an actual regex for doing it either... :)

remedy. Over a year ago

@Fred-ii- You did this using regex?

Funk Forty Niner Over a year ago

I used in_array() @charlesisjan - No regex used.

|

Collectives™ on Stack Overflow

Check if SQL input is valid SQL [duplicate]

3 Answers 3

1 Comment

Comments

7 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

7 Comments

Linked

Related