How can I escape strings using sqlsrv_* functions?

Question

How can i use real_escape_string in sqlsrv?

This is my code:

$uname = sqlsrv_real_escape_string($conn, trim($_POST['uname']));
$pass  = sqlsrv_real_escape_string($conn, trim($_POST['pword']));

but I recieve the following error:

undefined function sqlsrv_real_escape_string

This might be a duplicate to stackoverflow.com/questions/574805/… — unknown6656
– unknown6656, Commented Jun 22, 2017 at 6:05
If you use prepared statements with binds, this should solve a lot of the problems that real escape string is designed to cover. — Nigel Ren
– Nigel Ren, Commented Jun 22, 2017 at 6:18
In general *_escape_string is to wrong way to do escaping. You should use prepared statements with bind parameters and let the database handle all the escaping. Try looking into PDO — rypskar
– rypskar, Commented Jun 22, 2017 at 6:19
As far as I know they never cared writing such feature (probably because it's a modern extension and the functionality wouldn't specially useful). If it's important for you, you may want to try whether the PDO flavour implements PDO::quote(). — Álvaro González
– Álvaro González, Commented Jun 22, 2017 at 16:39

miken32 · Accepted Answer · 2017-06-22 16:33:38Z

6

The SQL Server code makes prepared statements very easy to do:

$query = "SELECT * FROM users WHERE username=? AND password=?";
$parameters = [$_POST["uname"], $_POST["pword"]];
$result = sqlsrv_query($conn, $query, $parameters);

Simply replace your values with a ? and then pass them as an array (in order) as the third argument to sqlsrv_query().

(Not that you would ever store plaintext passwords in a databse, right?)

answered Jun 22, 2017 at 16:33

miken32

42.5k16 gold badges127 silver badges177 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Sᴀᴍ Onᴇᴌᴀ · Accepted Answer · 2017-07-26 14:02:01Z

-2

I understand why you would want to use this to capture innocent ' and weed out SQL injections, but there is no such function sqlsrv_real_escape_string. You could make your own function or use preg_replace and add '\'. Just a thought.

Take a look at the answers to this question

edited Jul 26, 2017 at 14:02

Sᴀᴍ Onᴇᴌᴀ

8,3028 gold badges38 silver badges61 bronze badges

answered Jul 26, 2017 at 13:42

JustoShow

921 silver badge4 bronze badges

Collectives™ on Stack Overflow

How can I escape strings using sqlsrv_* functions?

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related