Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

real_escape() is a function which needs memory for its functionality, so I was wondering that is there any necessity to do that if we've already cast it?

$num = (int) $num;

can we use real_escape() just for string parameters?

share|improve this question
1  
You should never be using functions (standard or not) to escape SQL strings. You should be using prepared statements with something like PDO. Prepared statements cannot be injected. You cannot make a mistake. It's 2012 already and there is no reason to still be escaping SQL strings or values yourself. –  Mike Weller Jun 6 '12 at 12:16
add comment

3 Answers

up vote 4 down vote accepted

It's true that casting can mitigate SQL injections, but unless performance is a huge concern for you, I'd use mysqli_real_escape_string() anyway, for two reasons:

  1. Your application might change in the future. Even if your application is only passing integers into your queries right now (via this particular function call or whatever), your code may be modified in the future to accept strings, etc. I'd propose that you're better off planning ahead a bit, and that you should seal off this potential future security vulnerability right now, while it's on your mind.

  2. A less experienced developer might "refactor" away that cast. I can see a junior dev coming through your code at some point and saying, "Why is this cast here? We're only passing IDs into the SQL anyway," and then refactoring away that cast. I'd recommend using mysqli_real_escape_string() even if only to give future developers a heads-up that there's a security issue at stake here.

At the very least, if you're going to rely on a cast to implement security, I'd leave some very conspicious ALL CAPS comments in your code to make it clear that that's what you're doing.

share|improve this answer
    
makes more sense –  Sheriff Apr 16 '12 at 4:00
add comment

You are right. If you know it is an int (because you cast it to int), you do not need to call mysql_real_escape_string().

P.S. I'll go out on a limb and express an opinion. For most purposes, prepared statements are a better defense against SQL injection than manually applying escaping functions. (I'm sure there are PHP folks somewhere who will give me a hard time about this, or point out that some database systems on PHP don't support prepared statements.)

share|improve this answer
    
thanks for the prepared statement, It's awesome for escaping data, but the problem is performance issues in large scale databases. –  Sheriff Apr 15 '12 at 6:32
1  
Besides prepared statements there are also parameterized statements that serve the same purpose. –  Gumbo Apr 15 '12 at 8:03
1  
@Sheriff: Performance issues? And you think the escaped version is going to do any better? –  Billy ONeal Apr 16 '12 at 6:01
    
Don't forget that the old mysql_* functions will be deprecated soon and the PHP developers do not recommend using them. Parameterised queries in MySQLi are the way to go, really. –  Polynomial Apr 21 '12 at 15:08
add comment

In this example - if you cast variable - there is no need to do any other sanitization. But remember that casting must be prepared on the PHP-level. Don't even think about casting in your SQL query!

Correct:

    mysql_query("SELECT * FROM users WHERE id=".(int)$_GET['id']) 

This one leads to Blind SQL Injection:

    mysql_query("SELECT * FROM users WHERE id=CAST(".$_GET['id']." AS UNSIGNED)")

?id=1 AS UNSIGNED) AND 1337=BENCHMARK(13371337,MD5('ouch!'))--

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.