Let's say, when server-side application (like WordPress) applies add_magic_quotes to all GET/POST parameters ( $_GET = add_magic_quotes($_GET); ), so calling the url:

example.com/?id=a'b

the app now has safe variables, and executing the SQL query seems no longer harmful:

$id = $_GET['id']; //----> a\'b 
$mysql->query("Select .....   where id='$id'");

Is there any case, when it may still be a security threat? Any examples, please? How that SQL query can be unsecure, as it have escaped \' character inside $id?

There are a couple of (possible) issues:

  • Everything that doesn't come from GET/POST is still a danger (possible sources may be files, emails, databases, etc).

  • SQL queries where you need to remove the quote or don't need a quote in the first place (eg in LIMIT, for id values (eg SELECT from x WHERE id = $_GET['x'])) or further transform the input (eg in IN).

  • Encoding issues (see eg addslashes bypass via multibyte characters).
  • Improper escaping (eg not escaping \ as well).
  • Removal of quotes in other places in the code (adding quotes on input mangles your data; in some places, you might require clean data, which you might then pass on and further process; somewhere down the line this might end up in a query).

As you mention WordPress: That there are WordPress plugins which have SQL injection vulnerabilities should demonstrate that adding magic quotes is not good enough in all situations.

Escaping as defense against SQL injection is just a mess (security as well as usability wise). If you are building a new app, just use prepared statements (they are the standard for a reason). If you have a legacy app, carefully using escaping can be good enough though.

  • 2
    @T.Todua add_magic_quotes uses addslashes, so depending on your setup, you might be vulnerable to multibyte character issues (see link, or google "addslashes bypass"), so I would check that. Other than that, it's secure (though not recommended). – tim Oct 20 at 14:17
  • please incorporate this comment in answer and i will mark it as accepted – T.Todua Oct 20 at 15:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.